KMSAN: kernel-infoleak in move_addr_to_user (6)

Status: fixed on 2022/03/08 16:11
Subsystems: tipc
[Documentation on labels]
Reported-by: syzbot+cdbd40e0c3ca02cae3b7@syzkaller.appspotmail.com
Fix commit: d6d86830705f net ticp:fix a kernel-infoleak in __tipc_sendmsg()
First crash: 1683d, last: 1642d
▶ ▼ Discussions (3)
Title Replies (including bot) Last reply
[PATCH 5.15 00/72] 5.15.14-rc1 review 82 (82) 2022/01/11 12:41
[PATCH v2] net ticp:fix a kernel-infoleak in __tipc_sendmsg() 2 (2) 2022/01/01 02:50
[syzbot] KMSAN: kernel-infoleak in move_addr_to_user (6) 1 (2) 2021/12/21 20:33
▶ ▼ Similar bugs (11)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: kernel-infoleak in move_addr_to_user (3) net 9 C 79 2140d 2174d 15/29 fixed on 2020/09/28 09:09
upstream KMSAN: kernel-infoleak in move_addr_to_user (2) net 9 C 8 2679d 2694d 11/29 fixed on 2019/03/28 12:00
upstream KMSAN: kernel-infoleak in move_addr_to_user (7) prio:high hams wpan 9 C 46 86d 673d 29/29 fixed on 2026/07/15 08:27
upstream KMSAN: kernel-infoleak in move_addr_to_user (4) net 9 C 59 1972d 2024d 19/29 fixed on 2021/03/10 01:48
upstream KMSAN: kernel-infoleak in move_addr_to_user (5) tipc 9 3 1821d 1963d 20/29 fixed on 2021/11/10 00:50
upstream KMSAN: kernel-infoleak in move_addr_to_user net 9 5 2707d 2757d 11/29 fixed on 2019/03/06 07:43
upstream KMSAN: kernel-infoleak in copyout (2) net 17 C 6723 1145d 2314d 22/29 fixed on 2023/06/08 14:41
upstream KMSAN: uninit-value in nf_nat_setup_info (2) netfilter 7 C 764 1582d 1662d 0/29 auto-obsoleted due to no activity on 2022/09/28 07:28
upstream KMSAN: kernel-infoleak in __skb_datagram_iter net 9 68 1035d 1140d 23/29 fixed on 2023/09/28 17:51
upstream KMSAN: uninit-value in eth_type_trans (2) prio:high net 7 C 8753 40d 2378d 0/29 upstream: reported C repro on 2020/01/22 16:47
upstream KMSAN: uninit-value in sctp_inq_pop (2) sctp 7 C 4089 347d 1661d 29/29 fixed on 2025/10/09 01:15

Sample crash report:
=====================================================
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:121 [inline]
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:121 [inline] lib/usercopy.c:33
BUG: KMSAN: kernel-infoleak in _copy_to_user+0x1c9/0x270 lib/usercopy.c:33 lib/usercopy.c:33
 instrument_copy_to_user include/linux/instrumented.h:121 [inline]
 instrument_copy_to_user include/linux/instrumented.h:121 [inline] lib/usercopy.c:33
 _copy_to_user+0x1c9/0x270 lib/usercopy.c:33 lib/usercopy.c:33
 copy_to_user include/linux/uaccess.h:209 [inline]
 copy_to_user include/linux/uaccess.h:209 [inline] net/socket.c:287
 move_addr_to_user+0x3f6/0x600 net/socket.c:287 net/socket.c:287
 __sys_getpeername+0x470/0x6b0 net/socket.c:1987 net/socket.c:1987
 __do_sys_getpeername net/socket.c:1997 [inline]
 __se_sys_getpeername net/socket.c:1994 [inline]
 __do_sys_getpeername net/socket.c:1997 [inline] net/socket.c:1994
 __se_sys_getpeername net/socket.c:1994 [inline] net/socket.c:1994
 __x64_sys_getpeername+0xda/0x120 net/socket.c:1994 net/socket.c:1994
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_x64 arch/x86/entry/common.c:51 [inline] arch/x86/entry/common.c:82
 do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Uninit was stored to memory at:
 tipc_getname+0x575/0x5e0 net/tipc/socket.c:757 net/tipc/socket.c:757
 __sys_getpeername+0x3b3/0x6b0 net/socket.c:1984 net/socket.c:1984
 __do_sys_getpeername net/socket.c:1997 [inline]
 __se_sys_getpeername net/socket.c:1994 [inline]
 __do_sys_getpeername net/socket.c:1997 [inline] net/socket.c:1994
 __se_sys_getpeername net/socket.c:1994 [inline] net/socket.c:1994
 __x64_sys_getpeername+0xda/0x120 net/socket.c:1994 net/socket.c:1994
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_x64 arch/x86/entry/common.c:51 [inline] arch/x86/entry/common.c:82
 do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Uninit was stored to memory at:
 msg_set_word net/tipc/msg.h:212 [inline]
 msg_set_destport net/tipc/msg.h:619 [inline]
 msg_set_word net/tipc/msg.h:212 [inline] net/tipc/socket.c:1486
 msg_set_destport net/tipc/msg.h:619 [inline] net/tipc/socket.c:1486
 __tipc_sendmsg+0x44fa/0x5890 net/tipc/socket.c:1486 net/tipc/socket.c:1486
 tipc_sendmsg+0xeb/0x140 net/tipc/socket.c:1402 net/tipc/socket.c:1402
 sock_sendmsg_nosec net/socket.c:704 [inline]
 sock_sendmsg net/socket.c:724 [inline]
 sock_sendmsg_nosec net/socket.c:704 [inline] net/socket.c:2409
 sock_sendmsg net/socket.c:724 [inline] net/socket.c:2409
 ____sys_sendmsg+0xe11/0x12c0 net/socket.c:2409 net/socket.c:2409
 ___sys_sendmsg net/socket.c:2463 [inline]
 ___sys_sendmsg net/socket.c:2463 [inline] net/socket.c:2492
 __sys_sendmsg+0x704/0x840 net/socket.c:2492 net/socket.c:2492
 __do_sys_sendmsg net/socket.c:2501 [inline]
 __se_sys_sendmsg net/socket.c:2499 [inline]
 __do_sys_sendmsg net/socket.c:2501 [inline] net/socket.c:2499
 __se_sys_sendmsg net/socket.c:2499 [inline] net/socket.c:2499
 __x64_sys_sendmsg+0xe2/0x120 net/socket.c:2499 net/socket.c:2499
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_x64 arch/x86/entry/common.c:51 [inline] arch/x86/entry/common.c:82
 do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Local variable skaddr created at:
 __tipc_sendmsg+0x2d0/0x5890 net/tipc/socket.c:1419 net/tipc/socket.c:1419
 tipc_sendmsg+0xeb/0x140 net/tipc/socket.c:1402 net/tipc/socket.c:1402

Bytes 4-7 of 16 are uninitialized
Memory access of size 16 starts at ffff888113753e00
Data copied to user address 0000000020000280

CPU: 1 PID: 3479 Comm: syz-executor115 Not tainted 5.16.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
=====================================================

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/12/17 12:20 https://github.com/google/kmsan.git master b0a8b5053e8b 44068e19 .config console log report syz C ci-upstream-kmsan-gce KMSAN: kernel-infoleak in move_addr_to_user
2021/12/30 05:11 https://github.com/google/kmsan.git master 81c325bbf94e 6cc879d4 .config console log report info ci-upstream-kmsan-gce KMSAN: kernel-infoleak in move_addr_to_user
2021/12/17 11:04 https://github.com/google/kmsan.git master b0a8b5053e8b 44068e19 .config console log report info ci-upstream-kmsan-gce KMSAN: kernel-infoleak in move_addr_to_user
2022/01/27 15:15 https://github.com/google/kmsan.git master 85cfd6e539bd 2cbffd88 .config console log report info ci-upstream-kmsan-gce-386 KMSAN: kernel-infoleak in move_addr_to_user
* Struck through repros no longer work on HEAD.