syzbot


KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user (2)

Status: upstream: reported C repro on 2023/10/21 18:49
Subsystems: kernel
[Documentation on labels]
Reported-by: syzbot+cfc08744435c4cf94a40@syzkaller.appspotmail.com
First crash: 196d, last: 18h41m
Discussions (3)
Title Replies (including bot) Last reply
[syzbot] [kernel?] KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user (2) 1 (5) 2024/03/24 09:13
[PATCH] ptrace: fix kernel-infoleak-after-free in copy_siginfo_to_user 1 (1) 2023/12/31 02:41
Re: [syzbot] [kernel?] KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user (2) 1 (1) 2023/12/25 07:16
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user kernel 6 621d 664d 0/26 auto-obsoleted due to no activity on 2022/11/12 22:39
upstream KMSAN: kernel-infoleak in copy_siginfo_to_user (2) kernel C 15 1782d 1811d 12/26 fixed on 2019/07/10 21:40
upstream KMSAN: kernel-infoleak in copy_siginfo_to_user kernel C 779 1824d 2118d 0/26 closed as invalid on 2019/05/03 14:05
Last patch testing requests (1)
Created Duration User Patch Repo Result
2023/12/31 01:51 22m eadavis@qq.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 861deac3b092 OK log

Sample crash report:
=====================================================
BUG: KMSAN: kernel-infoleak-after-free in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
BUG: KMSAN: kernel-infoleak-after-free in _copy_to_user+0xbc/0x110 lib/usercopy.c:40
 instrument_copy_to_user include/linux/instrumented.h:114 [inline]
 _copy_to_user+0xbc/0x110 lib/usercopy.c:40
 copy_to_user include/linux/uaccess.h:191 [inline]
 copy_siginfo_to_user+0x40/0x130 kernel/signal.c:3380
 ptrace_request+0xfa7/0x36e0 kernel/ptrace.c:1046
 arch_ptrace+0x43b/0x680 arch/x86/kernel/ptrace.c:848
 __do_sys_ptrace kernel/ptrace.c:1285 [inline]
 __se_sys_ptrace+0x2d8/0x760 kernel/ptrace.c:1258
 __x64_sys_ptrace+0xbd/0x110 kernel/ptrace.c:1258
 do_syscall_64+0xd5/0x1f0
 entry_SYSCALL_64_after_hwframe+0x6d/0x75

Uninit was stored to memory at:
 copy_siginfo include/linux/signal.h:18 [inline]
 ptrace_getsiginfo kernel/ptrace.c:685 [inline]
 ptrace_request+0xf33/0x36e0 kernel/ptrace.c:1044
 arch_ptrace+0x43b/0x680 arch/x86/kernel/ptrace.c:848
 __do_sys_ptrace kernel/ptrace.c:1285 [inline]
 __se_sys_ptrace+0x2d8/0x760 kernel/ptrace.c:1258
 __x64_sys_ptrace+0xbd/0x110 kernel/ptrace.c:1258
 do_syscall_64+0xd5/0x1f0
 entry_SYSCALL_64_after_hwframe+0x6d/0x75

Uninit was stored to memory at:
 copy_siginfo include/linux/signal.h:18 [inline]
 collect_signal kernel/signal.c:587 [inline]
 __dequeue_signal+0x501/0xad0 kernel/signal.c:616
 dequeue_signal+0x14b/0xb20 kernel/signal.c:639
 get_signal+0xb46/0x2d00 kernel/signal.c:2790
 arch_do_signal_or_restart+0x53/0xcb0 arch/x86/kernel/signal.c:310
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x5d/0x160 kernel/entry/common.c:218
 do_syscall_64+0xe4/0x1f0 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x6d/0x75

Uninit was created at:
 slab_free_hook mm/slub.c:2073 [inline]
 slab_free mm/slub.c:4280 [inline]
 kmem_cache_free+0x257/0xa80 mm/slub.c:4344
 __sigqueue_free kernel/signal.c:451 [inline]
 collect_signal kernel/signal.c:594 [inline]
 __dequeue_signal+0xa58/0xad0 kernel/signal.c:616
 dequeue_signal+0x14b/0xb20 kernel/signal.c:639
 get_signal+0xb46/0x2d00 kernel/signal.c:2790
 arch_do_signal_or_restart+0x53/0xcb0 arch/x86/kernel/signal.c:310
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x5d/0x160 kernel/entry/common.c:218
 do_syscall_64+0xe4/0x1f0 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x6d/0x75

Bytes 12-15 of 48 are uninitialized
Memory access of size 48 starts at ffff8881240cfc60
Data copied to user address 0000000014dcf540

CPU: 1 PID: 5012 Comm: strace-static-x Not tainted 6.8.0-syzkaller-13213-g70293240c5ce #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
=====================================================

Crashes (1095):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/03/24 09:12 upstream 70293240c5ce 0ea90952 .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/25 18:06 upstream e88c4cfcb7b8 8bdc0f22 .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/03/21 00:20 upstream a4145ce1e7bc 5b7d42ae .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/03/16 20:25 upstream 66a27abac311 d615901c .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/03/12 04:02 upstream 8ede842f669b 6ee49f2e .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/03/11 15:10 upstream e8f897f4afef 6ee49f2e .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/02/25 06:07 upstream f2e367d6ad3b 8d446f15 .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/01/22 18:22 upstream 9f8413c4a66f 9bd8dcda .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/01/16 01:26 upstream 9f8413c4a66f 2a7bcc7f .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/01/11 20:22 upstream 9f8413c4a66f 00f3cc59 .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/01/10 11:25 upstream 9f8413c4a66f b438bd66 .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/01/08 05:03 upstream 0dd3ee311255 d0304e9c .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/01/05 18:06 upstream 1f874787ed9a 28c42cff .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/01/03 14:13 upstream 610a9b8f49fb fb427a07 .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/01/03 00:51 upstream 610a9b8f49fb fb427a07 .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/01/02 16:13 upstream 610a9b8f49fb fb427a07 .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2023/12/28 00:59 upstream fbafc3e621c3 fb427a07 .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2023/12/27 16:54 upstream fbafc3e621c3 fb427a07 .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2023/12/25 22:15 upstream 861deac3b092 fb427a07 .config strace log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/03/11 17:52 upstream e8f897f4afef 6ee49f2e .config console log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/01/30 11:52 upstream 9f8413c4a66f 991a98f4 .config console log report syz [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/26 11:28 upstream c942a0cd3603 059e9963 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/26 02:47 upstream e33c4963bf53 8bdc0f22 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/25 12:03 upstream e88c4cfcb7b8 8bdc0f22 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/25 02:53 upstream e88c4cfcb7b8 8bdc0f22 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/24 09:40 upstream 9d1ddab261f3 21339d7b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/24 07:52 upstream 9d1ddab261f3 21339d7b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/23 06:40 upstream 4d2008430ce8 21339d7b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/22 11:12 upstream ed30a4a51bb1 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/22 07:33 upstream 3b68086599f8 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/21 23:09 upstream 3b68086599f8 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/21 20:51 upstream 3b68086599f8 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/21 17:14 upstream 977b1ef51866 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/21 06:47 upstream 977b1ef51866 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/21 00:44 upstream 977b1ef51866 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/20 23:40 upstream 977b1ef51866 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/20 03:56 upstream 3cdb45594619 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/19 03:37 upstream 8cd26fd90c1a af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/17 15:08 upstream 96fca68c4fbf 18f6e127 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/17 12:04 upstream 96fca68c4fbf 18f6e127 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/17 02:13 upstream 96fca68c4fbf 18f6e127 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/16 19:37 upstream 96fca68c4fbf 0d592ce4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/16 03:37 upstream 0bbac3facb5d 0d592ce4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/16 02:16 upstream 0bbac3facb5d 0d592ce4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/14 08:39 upstream fa4022cb7361 c8349e48 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/11 01:29 upstream 2c71fdf02a95 56086b24 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/10 08:38 upstream 2c71fdf02a95 56086b24 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/08 02:46 upstream 9fe30842a90b ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/25 22:29 upstream e33c4963bf53 8bdc0f22 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/25 19:25 upstream e88c4cfcb7b8 8bdc0f22 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/25 05:08 upstream e88c4cfcb7b8 8bdc0f22 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/24 17:52 upstream 9d1ddab261f3 8bdc0f22 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/24 16:12 upstream 9d1ddab261f3 8bdc0f22 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/22 02:43 upstream 48cf398f15fc af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/21 13:59 upstream 977b1ef51866 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/18 20:13 upstream 8cd26fd90c1a af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/18 07:49 upstream 4b6b51322118 bd38b692 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/18 06:22 upstream 4b6b51322118 bd38b692 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/17 19:37 upstream 96fca68c4fbf bd38b692 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/16 04:37 upstream 0bbac3facb5d 0d592ce4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/15 04:21 upstream 0bbac3facb5d c8349e48 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/14 14:12 upstream 7efd0a74039f c8349e48 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/11 13:03 upstream e8c39d0f57f3 478efa7f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/10 09:16 upstream 2c71fdf02a95 56086b24 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2023/12/19 21:48 upstream 2cf4f94d8e86 3ad490ea .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386 KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2023/10/19 22:11 upstream dd72f9c7e512 42e1d524 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386 KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2023/10/13 09:10 upstream ce583d5fb9d3 6388bc36 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386 KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user
2024/04/20 06:45 upstream 3cdb45594619 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in copy_siginfo_to_user
2024/04/17 12:27 upstream 96fca68c4fbf 18f6e127 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in copy_siginfo_to_user
* Struck through repros no longer work on HEAD.