syzbot

 sign-in | mailing list | source | docs
🐞 Open [997] ≡ Subsystems 🐞 Fixed [5242] 🐞 Invalid [12511] ⬇ Missing Backports [84] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

KMSAN: uninit-value in _copy_to_iter (2)

Status: fixed on 2018/07/09 18:05
Subsystems: kvm net virt
[Documentation on labels]
Reported-by: syzbot+87cfa083e727a224754b@syzkaller.appspotmail.com
Fix commit: 670ae9caaca4 vhost: fix info leak due to uninitialized memory
First crash: 2195d, last: 2149d
▶ ▼ Discussions (8)
Title Replies (including bot) Last reply
[PATCH 4.17 00/70] 4.17.3-stable review 75 (75) 2018/06/25 23:48
[PATCH 4.16 00/64] 4.16.18-stable review 66 (66) 2018/06/25 17:20
[PATCH 4.14 00/52] 4.14.52-stable review 54 (54) 2018/06/25 17:19
[PATCH 4.9 00/39] 4.9.110-stable review 39 (39) 2018/06/25 17:18
[PULL] vhost: cleanups and fixes 9 (9) 2018/06/15 03:53
[PULL v2] vhost, virtio 1 (1) 2018/06/13 23:45
KMSAN: uninit-value in _copy_to_iter (2) 7 (12) 2018/06/07 19:29
[PATCH net] vhost: Use kzalloc() to allocate vhost_msg_node 18 (18) 2018/06/04 12:34
▶ ▼ Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in _copy_to_iter crypto C 32 2196d 2211d 0/26 closed as invalid on 2018/04/22 15:44
upstream KMSAN: uninit-value in _copy_to_iter (3) can C 155 1373d 1374d 0/26 auto-obsoleted due to no activity on 2022/12/09 13:47

Sample crash report:
==================================================================
BUG: KMSAN: uninit-value in copyout lib/iov_iter.c:140 [inline]
BUG: KMSAN: uninit-value in _copy_to_iter+0x46d/0x28f0 lib/iov_iter.c:571
CPU: 1 PID: 4516 Comm: syz-executor879 Not tainted 4.16.0+ #87
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x185/0x1d0 lib/dump_stack.c:53
 kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067
 kmsan_internal_check_memory+0x135/0x1e0 mm/kmsan/kmsan.c:1157
 kmsan_copy_to_user+0x69/0x160 mm/kmsan/kmsan.c:1199
 copyout lib/iov_iter.c:140 [inline]
 _copy_to_iter+0x46d/0x28f0 lib/iov_iter.c:571
 copy_to_iter include/linux/uio.h:106 [inline]
 vhost_chr_read_iter+0x7ac/0xc50 drivers/vhost/vhost.c:1104
 vhost_net_chr_read_iter+0xf6/0x130 drivers/vhost/net.c:1365
 call_read_iter include/linux/fs.h:1776 [inline]
 aio_read+0x5c1/0x6f0 fs/aio.c:1517
 io_submit_one fs/aio.c:1633 [inline]
 do_io_submit+0x1bb4/0x2f60 fs/aio.c:1698
 SYSC_io_submit+0x98/0xb0 fs/aio.c:1723
 SyS_io_submit+0x56/0x80 fs/aio.c:1720
 do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x3d/0xa2
RIP: 0033:0x4457b9
RSP: 002b:00007ff9343e4da8 EFLAGS: 00000293 ORIG_RAX: 00000000000000d1
RAX: ffffffffffffffda RBX: 00000000006dac44 RCX: 00000000004457b9
RDX: 00000000200001c0 RSI: 0000000000000001 RDI: 00007ff93439a000
RBP: 00000000006dac40 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: 901aeeff3a98f9ab
R13: 98c94b26f489688e R14: ae1b2dfa3c87200a R15: 0000000000000001

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline]
 kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:188
 kmsan_kmalloc+0x94/0x100 mm/kmsan/kmsan.c:314
 __kmalloc+0x23c/0x350 mm/slub.c:3791
 kmalloc include/linux/slab.h:517 [inline]
 vhost_new_msg drivers/vhost/vhost.c:2340 [inline]
 vhost_iotlb_miss drivers/vhost/vhost.c:1124 [inline]
 translate_desc+0xbef/0x1120 drivers/vhost/vhost.c:1829
 __vhost_get_user_slow drivers/vhost/vhost.c:812 [inline]
 __vhost_get_user drivers/vhost/vhost.c:846 [inline]
 vhost_update_used_flags+0x469/0x8d0 drivers/vhost/vhost.c:1715
 vhost_vq_init_access+0x173/0xa20 drivers/vhost/vhost.c:1763
 vhost_net_set_backend drivers/vhost/net.c:1166 [inline]
 vhost_net_ioctl+0x22b0/0x3480 drivers/vhost/net.c:1322
 vfs_ioctl fs/ioctl.c:46 [inline]
 do_vfs_ioctl+0xaf0/0x2440 fs/ioctl.c:686
 SYSC_ioctl+0x1d2/0x260 fs/ioctl.c:701
 SyS_ioctl+0x54/0x80 fs/ioctl.c:692
 do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x3d/0xa2

Bytes 4-7 of 72 are uninitialized
==================================================================

Crashes (226):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/04/25 19:18 https://github.com/google/kmsan.git master d2d741e5d189 73417389 .config console log report syz C ci-upstream-kmsan-gce
2018/06/08 00:02 https://github.com/google/kmsan.git master c6a6aed994b6 645e75f8 .config console log report ci-upstream-kmsan-gce
2018/06/07 21:56 https://github.com/google/kmsan.git master c6a6aed994b6 645e75f8 .config console log report ci-upstream-kmsan-gce
2018/06/07 20:12 https://github.com/google/kmsan.git master c6a6aed994b6 645e75f8 .config console log report ci-upstream-kmsan-gce
2018/06/07 10:51 https://github.com/google/kmsan.git master 6d08036f7a00 d2ba33fa .config console log report ci-upstream-kmsan-gce
2018/06/07 06:58 https://github.com/google/kmsan.git master b9a5d319699c e0e534c6 .config console log report ci-upstream-kmsan-gce
2018/06/07 02:39 https://github.com/google/kmsan.git master b9a5d319699c e0e534c6 .config console log report ci-upstream-kmsan-gce
2018/06/06 20:10 https://github.com/google/kmsan.git master b9a5d319699c 41f9540d .config console log report ci-upstream-kmsan-gce
2018/06/06 12:52 https://github.com/google/kmsan.git master 8fc8ecd1c58a 41f9540d .config console log report ci-upstream-kmsan-gce
2018/06/06 11:01 https://github.com/google/kmsan.git master 8fc8ecd1c58a 41f9540d .config console log report ci-upstream-kmsan-gce
2018/06/06 07:46 https://github.com/google/kmsan.git master 8fc8ecd1c58a 863a24bb .config console log report ci-upstream-kmsan-gce
2018/06/05 22:54 https://github.com/google/kmsan.git master 8fc8ecd1c58a 863a24bb .config console log report ci-upstream-kmsan-gce
2018/06/05 19:17 https://github.com/google/kmsan.git master 8fc8ecd1c58a a316ff92 .config console log report ci-upstream-kmsan-gce
2018/06/05 10:01 https://github.com/google/kmsan.git master 8fc8ecd1c58a a316ff92 .config console log report ci-upstream-kmsan-gce
2018/06/05 04:09 https://github.com/google/kmsan.git master 8fc8ecd1c58a a50d873b .config console log report ci-upstream-kmsan-gce
2018/06/04 23:42 https://github.com/google/kmsan.git master 8fc8ecd1c58a a50d873b .config console log report ci-upstream-kmsan-gce
2018/06/04 22:26 https://github.com/google/kmsan.git master 8fc8ecd1c58a a50d873b .config console log report ci-upstream-kmsan-gce
2018/06/04 16:15 https://github.com/google/kmsan.git master 8fc8ecd1c58a 6cbe7c26 .config console log report ci-upstream-kmsan-gce
2018/06/04 13:12 https://github.com/google/kmsan.git master 8fc8ecd1c58a 6cbe7c26 .config console log report ci-upstream-kmsan-gce
2018/06/03 23:03 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/06/03 21:35 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/06/03 18:45 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/06/03 14:23 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/06/03 10:19 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/06/03 09:03 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/06/03 04:07 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/06/03 00:01 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/06/02 21:14 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/06/02 17:54 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/06/02 16:12 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/06/02 13:15 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/06/01 22:05 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/06/01 19:17 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/06/01 17:08 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/06/01 12:14 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/06/01 08:17 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/06/01 06:46 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/06/01 04:50 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/06/01 02:02 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/05/31 17:20 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/05/31 05:55 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/05/31 04:42 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/05/30 19:24 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/05/30 16:11 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/05/30 14:36 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/05/30 06:32 https://github.com/google/kmsan.git master 1b9cd4eccac9 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/05/30 02:07 https://github.com/google/kmsan.git master 1b9cd4eccac9 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/04/22 19:29 https://github.com/google/kmsan.git master d2d741e5d189 d23fcf6c .config console log report ci-upstream-kmsan-gce
* Struck through repros no longer work on HEAD.