syzbot


KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl (3)

Status: upstream: reported C repro on 2025/06/19 23:57
Subsystems: kernel
[Documentation on labels]
Reported-by: syzbot+9b9124ae9b12d5af5d95@syzkaller.appspotmail.com
First crash: 4d09h, last: 4d02h
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [kernel?] KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl (3) 0 (6) 2025/06/20 06:54
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl (2) kernel C 2 996d 995d 22/29 fixed on 2023/02/24 13:50
upstream KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl kernel C 22 1591d 1676d 19/29 fixed on 2021/03/10 01:48
Last patch testing requests (5)
Created Duration User Patch Repo Result
2025/06/20 06:52 1h51m lizhi.xu@windriver.com patch upstream report log
2025/06/20 05:23 34m lizhi.xu@windriver.com patch upstream report log
2025/06/20 04:21 6m lizhi.xu@windriver.com patch upstream error
2025/06/20 01:03 53m lizhi.xu@windriver.com patch upstream report log
2025/06/20 06:54 lizhi.xu@windriver.com patch upstream running

Sample crash report:
=====================================================
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
BUG: KMSAN: kernel-infoleak in _inline_copy_to_user include/linux/uaccess.h:196 [inline]
BUG: KMSAN: kernel-infoleak in _copy_to_user+0xcc/0x120 lib/usercopy.c:26
 instrument_copy_to_user include/linux/instrumented.h:114 [inline]
 _inline_copy_to_user include/linux/uaccess.h:196 [inline]
 _copy_to_user+0xcc/0x120 lib/usercopy.c:26
 copy_to_user include/linux/uaccess.h:225 [inline]
 vmci_host_do_receive_datagram drivers/misc/vmw_vmci/vmci_host.c:438 [inline]
 vmci_host_unlocked_ioctl+0x1e7e/0x5200 drivers/misc/vmw_vmci/vmci_host.c:932
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:907 [inline]
 __se_sys_ioctl+0x23c/0x400 fs/ioctl.c:893
 __x64_sys_ioctl+0x97/0xe0 fs/ioctl.c:893
 x64_sys_call+0x1ebe/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Local variable __x.i.i created at:
 set_xfeature_in_sigframe arch/x86/kernel/fpu/xstate.h:81 [inline]
 save_xstate_epilog arch/x86/kernel/fpu/signal.c:140 [inline]
 copy_fpstate_to_sigframe+0x11f2/0x13d0 arch/x86/kernel/fpu/signal.c:232
 get_sigframe+0xc6a/0x1020 arch/x86/kernel/signal.c:163

Bytes 28-31 of 40 are uninitialized
Memory access of size 40 starts at ffff888131f74080
Data copied to user address 000000000000a4bf

CPU: 1 UID: 0 PID: 5798 Comm: syz-executor419 Not tainted 6.16.0-rc1-syzkaller-00239-g08215f5486ec #0 PREEMPT(undef) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
=====================================================

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/06/16 06:38 upstream 08215f5486ec 5f4b362d .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl
2025/06/15 23:48 upstream 08215f5486ec 5f4b362d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl
2025/06/16 02:31 upstream 08215f5486ec 5f4b362d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl
2025/06/16 02:30 upstream 08215f5486ec 5f4b362d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl
* Struck through repros no longer work on HEAD.