KMSAN: uninit-value in mpol_rebind_mm (2)

Status: fixed on 2023/02/24 13:51
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+ad1b8c404f0959c4bfcc@syzkaller.appspotmail.com
Fix commit: 018160ad314d mm/mempolicy: fix uninit-value in mpol_rebind_policy()
First crash: 1642d, last: 1514d
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[PATCH] mm/mempolicy: fix uninit-value in mpol_rebind_policy() 4 (4) 2022/05/18 08:52
[syzbot] KMSAN: uninit-value in mpol_rebind_mm (2) 0 (1) 2022/02/11 09:07
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in mpol_rebind_mm mm 7 6 2692d 2776d 11/29 fixed on 2019/03/28 12:00
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2022/05/15 03:44 20m wanngchenng@gmail.com patch https://github.com/google/kmsan.git master OK

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in mpol_rebind_policy mm/mempolicy.c:352 [inline]
BUG: KMSAN: uninit-value in mpol_rebind_mm+0x35b/0x460 mm/mempolicy.c:383
 mpol_rebind_policy mm/mempolicy.c:352 [inline]
 mpol_rebind_mm+0x35b/0x460 mm/mempolicy.c:383
 cpuset_attach+0xe28/0x15e0 kernel/cgroup/cpuset.c:2291
 cgroup_migrate_execute+0x1023/0x1d20 kernel/cgroup/cgroup.c:2515
 cgroup_migrate kernel/cgroup/cgroup.c:2771 [inline]
 cgroup_attach_task+0x540/0x8b0 kernel/cgroup/cgroup.c:2804
 __cgroup1_procs_write+0x5cc/0x7a0 kernel/cgroup/cgroup-v1.c:520
 cgroup1_procs_write+0x97/0xb0 kernel/cgroup/cgroup-v1.c:533
 cgroup_file_write+0x4c2/0x9e0 kernel/cgroup/cgroup.c:3852
 kernfs_fop_write_iter+0x66a/0x9f0 fs/kernfs/file.c:296
 call_write_iter include/linux/fs.h:2162 [inline]
 new_sync_write fs/read_write.c:503 [inline]
 vfs_write+0x1318/0x2030 fs/read_write.c:590
 ksys_write+0x28b/0x510 fs/read_write.c:643
 __do_sys_write fs/read_write.c:655 [inline]
 __se_sys_write fs/read_write.c:652 [inline]
 __x64_sys_write+0xdb/0x120 fs/read_write.c:652
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Uninit was stored to memory at:
 __mpol_dup+0x107/0x480 mm/mempolicy.c:2326
 mpol_dup include/linux/mempolicy.h:87 [inline]
 vma_replace_policy mm/mempolicy.c:762 [inline]
 mbind_range+0x13ee/0x1e40 mm/mempolicy.c:833
 do_mbind+0x13d2/0x1b30 mm/mempolicy.c:1323
 kernel_mbind mm/mempolicy.c:1477 [inline]
 __do_sys_mbind mm/mempolicy.c:1484 [inline]
 __se_sys_mbind+0x51c/0xc80 mm/mempolicy.c:1480
 __x64_sys_mbind+0x19d/0x200 mm/mempolicy.c:1480
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Uninit was created at:
 slab_post_alloc_hook mm/slab.h:524 [inline]
 slab_alloc_node mm/slub.c:3251 [inline]
 slab_alloc mm/slub.c:3259 [inline]
 kmem_cache_alloc+0x902/0x11c0 mm/slub.c:3264
 mpol_new mm/mempolicy.c:293 [inline]
 do_mbind+0x8f5/0x1b30 mm/mempolicy.c:1279
 kernel_mbind mm/mempolicy.c:1477 [inline]
 __do_sys_mbind mm/mempolicy.c:1484 [inline]
 __se_sys_mbind+0x51c/0xc80 mm/mempolicy.c:1480
 __x64_sys_mbind+0x19d/0x200 mm/mempolicy.c:1480
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x44/0xae

CPU: 0 PID: 3474 Comm: syz-executor399 Not tainted 5.16.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
=====================================================

Crashes (11):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/02/07 09:54 https://github.com/google/kmsan.git master 85cfd6e539bd a7dab638 .config console log report syz C ci-upstream-kmsan-gce KMSAN: uninit-value in mpol_rebind_mm
2022/06/15 10:14 https://github.com/google/kmsan.git master 2f3064574275 127d1faf .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in mpol_rebind_mm
2022/05/22 02:52 https://github.com/google/kmsan.git master c5c93da9af13 7268fa62 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in mpol_rebind_mm
2022/05/13 21:06 https://github.com/google/kmsan.git master d6e2c8c7eb40 107f6434 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in mpol_rebind_mm
2022/04/25 01:33 https://github.com/google/kmsan.git master b834db009dc5 131df97d .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in mpol_rebind_mm
2022/04/11 10:46 https://github.com/google/kmsan.git master 33d9269ef6e0 e22c3da3 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in mpol_rebind_mm
2022/03/23 22:31 https://github.com/google/kmsan.git master 97c7732c2bb6 5ff41e94 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in mpol_rebind_mm
2022/03/19 11:39 https://github.com/google/kmsan.git master 97c7732c2bb6 e2d91b1d .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in mpol_rebind_mm
2022/03/06 23:01 https://github.com/google/kmsan.git master 724946410067 7bdd8b2c .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in mpol_rebind_mm
2022/02/07 08:40 https://github.com/google/kmsan.git master 85cfd6e539bd a7dab638 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in mpol_rebind_mm
2022/05/13 21:07 https://github.com/google/kmsan.git master d6e2c8c7eb40 107f6434 .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in mpol_rebind_mm
* Struck through repros no longer work on HEAD.