syzbot


KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern

Status: upstream: reported on 2024/05/06 08:26
Subsystems: net
[Documentation on labels]
Reported-by: syzbot+bbafcc77279b6c156e52@syzkaller.appspotmail.com
First crash: 138d, last: 2d02h
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [net?] KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern 0 (1) 2024/05/06 08:26

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern+0x568/0x10d0 net/compat.c:154
 cmsghdr_from_user_compat_to_kern+0x568/0x10d0 net/compat.c:154
 ____sys_sendmsg+0x222/0xb60 net/socket.c:2565
 __sys_sendmsg_sock+0x42/0x60 net/socket.c:2669
 io_sendmsg+0x36a/0xe30 io_uring/net.c:550
 io_issue_sqe+0x383/0x22c0 io_uring/io_uring.c:1721
 io_queue_sqe io_uring/io_uring.c:1935 [inline]
 io_submit_sqe io_uring/io_uring.c:2191 [inline]
 io_submit_sqes+0x1259/0x2f20 io_uring/io_uring.c:2306
 __do_sys_io_uring_enter io_uring/io_uring.c:3325 [inline]
 __se_sys_io_uring_enter+0x406/0x41c0 io_uring/io_uring.c:3261
 __ia32_sys_io_uring_enter+0x11d/0x1a0 io_uring/io_uring.c:3261
 ia32_sys_call+0x2d8f/0x40d0 arch/x86/include/generated/asm/syscalls_32.h:427
 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
 __do_fast_syscall_32+0xb0/0x110 arch/x86/entry/common.c:386
 do_fast_syscall_32+0x38/0x80 arch/x86/entry/common.c:411
 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:449
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e

Uninit was stored to memory at:
 io_sendmsg+0x691/0xe30 io_uring/net.c:548
 io_issue_sqe+0x383/0x22c0 io_uring/io_uring.c:1721
 io_queue_sqe io_uring/io_uring.c:1935 [inline]
 io_submit_sqe io_uring/io_uring.c:2191 [inline]
 io_submit_sqes+0x1259/0x2f20 io_uring/io_uring.c:2306
 __do_sys_io_uring_enter io_uring/io_uring.c:3325 [inline]
 __se_sys_io_uring_enter+0x406/0x41c0 io_uring/io_uring.c:3261
 __ia32_sys_io_uring_enter+0x11d/0x1a0 io_uring/io_uring.c:3261
 ia32_sys_call+0x2d8f/0x40d0 arch/x86/include/generated/asm/syscalls_32.h:427
 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
 __do_fast_syscall_32+0xb0/0x110 arch/x86/entry/common.c:386
 do_fast_syscall_32+0x38/0x80 arch/x86/entry/common.c:411
 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:449
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e

Uninit was created at:
 __alloc_pages_noprof+0x9d6/0xe70 mm/page_alloc.c:4725
 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
 alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
 alloc_slab_page mm/slub.c:2319 [inline]
 allocate_slab+0x203/0x1220 mm/slub.c:2482
 new_slab mm/slub.c:2535 [inline]
 ___slab_alloc+0x12ef/0x35e0 mm/slub.c:3721
 __kmem_cache_alloc_bulk mm/slub.c:4763 [inline]
 kmem_cache_alloc_bulk_noprof+0x486/0x1330 mm/slub.c:4835
 __io_alloc_req_refill+0x84/0x560 io_uring/io_uring.c:951
 io_alloc_req io_uring/io_uring.h:398 [inline]
 io_submit_sqes+0x171b/0x2f20 io_uring/io_uring.c:2295
 __do_sys_io_uring_enter io_uring/io_uring.c:3325 [inline]
 __se_sys_io_uring_enter+0x406/0x41c0 io_uring/io_uring.c:3261
 __ia32_sys_io_uring_enter+0x11d/0x1a0 io_uring/io_uring.c:3261
 ia32_sys_call+0x2d8f/0x40d0 arch/x86/include/generated/asm/syscalls_32.h:427
 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
 __do_fast_syscall_32+0xb0/0x110 arch/x86/entry/common.c:386
 do_fast_syscall_32+0x38/0x80 arch/x86/entry/common.c:411
 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:449
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e

CPU: 0 UID: 0 PID: 13367 Comm: syz.4.2274 Not tainted 6.11.0-syzkaller-04003-gfc1dc0d50780 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
=====================================================

Crashes (310):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/09/18 02:23 upstream fc1dc0d50780 c673ca06 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/09/16 04:41 upstream d42f7708e27c 08d8a733 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/09/16 01:13 upstream d42f7708e27c 08d8a733 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/09/16 00:56 upstream d42f7708e27c 08d8a733 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/09/15 12:16 upstream 0babf683783d 08d8a733 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/09/14 21:27 upstream b7718454f937 ff60e2ca .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/09/13 11:56 upstream 196145c606d0 73e8a465 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/09/12 06:52 upstream 7c6a3a65ace7 d94c83d8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/09/09 06:34 upstream 5dadc1be8fc5 9750182a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/09/08 16:26 upstream d1f2d51b711a 9750182a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/09/08 14:05 upstream d1f2d51b711a 9750182a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/09/08 10:05 upstream d1f2d51b711a 9750182a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/09/08 04:33 upstream d1f2d51b711a 9750182a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/09/07 15:59 upstream b31c44928842 9750182a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/09/07 01:52 upstream b831f83e40a2 ce70880a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/09/04 06:58 upstream 88fac17500f4 9d47f20a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/09/03 17:42 upstream 67784a74e258 512328ba .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/09/03 04:52 upstream 67784a74e258 abeaa9b9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/09/02 11:16 upstream c9f016e72b5c 1eda0d14 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/09/02 09:17 upstream c9f016e72b5c 1eda0d14 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/09/02 04:59 upstream c9f016e72b5c 1eda0d14 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/09/02 00:32 upstream 431c1646e1f8 1eda0d14 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/09/01 23:30 upstream 431c1646e1f8 1eda0d14 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/08/29 12:12 upstream 928f79a188aa ef3de9e8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/08/28 21:00 upstream 86987d84b968 940f38c1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/08/27 06:19 upstream 5be63fc19fca 9aee4e0b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/08/26 02:55 upstream 5be63fc19fca d7d32352 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/08/24 05:02 upstream 3d5f968a177d d7d32352 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/08/23 14:28 upstream aa0743a22936 ce8a9099 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/08/23 12:31 upstream aa0743a22936 ce8a9099 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/08/23 12:12 upstream aa0743a22936 ce8a9099 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/08/22 23:16 upstream 872cf28b8df9 295a4b50 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/08/20 05:44 upstream b0da640826ba 9f0ab3fb .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/08/20 04:22 upstream b0da640826ba 9f0ab3fb .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/08/19 00:58 upstream c3f2d783a459 dbc93b08 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/08/16 12:05 upstream d7a5aa4b3c00 e4bacdaf .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/08/16 00:22 upstream 1fb918967b56 e4bacdaf .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/08/15 06:03 upstream 9d5906799f7d e4bacdaf .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/08/15 05:11 upstream 9d5906799f7d e4bacdaf .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/08/14 14:19 upstream 6b0f8db921ab bde81f6f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/08/14 00:17 upstream d74da846046a f21a18ca .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/08/13 02:07 upstream 7c626ce4bae1 7b0f4b46 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/08/12 10:48 upstream 7006fe2f7f78 6f4edef4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/08/12 08:31 upstream 7006fe2f7f78 6f4edef4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
2024/05/05 05:13 upstream 7367539ad4b0 610f2a54 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
* Struck through repros no longer work on HEAD.