syzbot


KMSAN: uninit-value in sw842_decompress

Status: upstream: reported on 2024/11/25 12:10
Subsystems: crypto
[Documentation on labels]
Reported-by: syzbot+e774233ff687aada969e@syzkaller.appspotmail.com
First crash: 5d11h, last: 5d11h
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [crypto?] KMSAN: uninit-value in sw842_decompress 0 (1) 2024/11/25 12:10

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in sw842_decompress+0x7d4/0x24c0 lib/842/842_decompress.c:303
 sw842_decompress+0x7d4/0x24c0 lib/842/842_decompress.c:303
 crypto842_sdecompress+0x45/0x60 crypto/842.c:92
 scomp_acomp_comp_decomp+0x7c6/0xb90
 scomp_acomp_decompress+0x2f/0x40 crypto/scompress.c:192
 crypto_acomp_decompress include/crypto/acompress.h:265 [inline]
 zswap_decompress+0x5ff/0xa30 mm/zswap.c:981
 zswap_load+0x2b7/0x5c0 mm/zswap.c:1576
 swap_read_folio+0x6c6/0x2ac0 mm/page_io.c:634
 swap_cluster_readahead+0xb48/0xbd0 mm/swap_state.c:706
 swapin_readahead+0x205/0x1690 mm/swap_state.c:882
 do_swap_page+0xade/0x9b20 mm/memory.c:4324
 handle_pte_fault mm/memory.c:5769 [inline]
 __handle_mm_fault mm/memory.c:5909 [inline]
 handle_mm_fault+0x3f29/0xdca0 mm/memory.c:6077
 do_user_addr_fault arch/x86/mm/fault.c:1389 [inline]
 handle_page_fault arch/x86/mm/fault.c:1481 [inline]
 exc_page_fault+0x29f/0x700 arch/x86/mm/fault.c:1539
 asm_exc_page_fault+0x2b/0x30 arch/x86/include/asm/idtentry.h:623
 compat_put_bitmap+0x133/0x390 kernel/compat.c:236
 compat_set_fd_set fs/select.c:1171 [inline]
 compat_core_sys_select+0x98b/0xe20 fs/select.c:1248
 do_compat_pselect+0x50e/0x5c0 fs/select.c:1338
 __do_compat_sys_pselect6_time32 fs/select.c:1386 [inline]
 __se_compat_sys_pselect6_time32 fs/select.c:1377 [inline]
 __ia32_compat_sys_pselect6_time32+0x2dd/0x410 fs/select.c:1377
 ia32_sys_call+0x1b34/0x4180 arch/x86/include/generated/asm/syscalls_32.h:309
 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
 __do_fast_syscall_32+0xb0/0x110 arch/x86/entry/common.c:386
 do_fast_syscall_32+0x38/0x80 arch/x86/entry/common.c:411
 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:449
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e

Uninit was stored to memory at:
 next_bits+0xd7a/0xe20 lib/842/842_decompress.c:118
 sw842_decompress+0x1c3/0x24c0 lib/842/842_decompress.c:297
 crypto842_sdecompress+0x45/0x60 crypto/842.c:92
 scomp_acomp_comp_decomp+0x7c6/0xb90
 scomp_acomp_decompress+0x2f/0x40 crypto/scompress.c:192
 crypto_acomp_decompress include/crypto/acompress.h:265 [inline]
 zswap_decompress+0x5ff/0xa30 mm/zswap.c:981
 zswap_load+0x2b7/0x5c0 mm/zswap.c:1576
 swap_read_folio+0x6c6/0x2ac0 mm/page_io.c:634
 swap_cluster_readahead+0xb48/0xbd0 mm/swap_state.c:706
 swapin_readahead+0x205/0x1690 mm/swap_state.c:882
 do_swap_page+0xade/0x9b20 mm/memory.c:4324
 handle_pte_fault mm/memory.c:5769 [inline]
 __handle_mm_fault mm/memory.c:5909 [inline]
 handle_mm_fault+0x3f29/0xdca0 mm/memory.c:6077
 do_user_addr_fault arch/x86/mm/fault.c:1389 [inline]
 handle_page_fault arch/x86/mm/fault.c:1481 [inline]
 exc_page_fault+0x29f/0x700 arch/x86/mm/fault.c:1539
 asm_exc_page_fault+0x2b/0x30 arch/x86/include/asm/idtentry.h:623

Uninit was created at:
 __alloc_pages_noprof+0x9a7/0xe00 mm/page_alloc.c:4774
 alloc_pages_mpol_noprof+0x299/0x990 mm/mempolicy.c:2265
 alloc_pages_noprof+0x1bf/0x1e0 mm/mempolicy.c:2345
 z3fold_alloc mm/z3fold.c:1036 [inline]
 z3fold_zpool_malloc+0x78f/0x1990 mm/z3fold.c:1388
 zpool_malloc+0x85/0xb0 mm/zpool.c:258
 zswap_compress mm/zswap.c:927 [inline]
 zswap_store+0x1f20/0x3650 mm/zswap.c:1460
 swap_writepage+0xa67/0x17f0 mm/page_io.c:279
 pageout mm/vmscan.c:689 [inline]
 shrink_folio_list+0x5e7f/0x7dd0 mm/vmscan.c:1367
 evict_folios+0x9813/0xbaf0 mm/vmscan.c:4589
 try_to_shrink_lruvec+0x13a3/0x1750 mm/vmscan.c:4784
 shrink_one+0x646/0xd20 mm/vmscan.c:4822
 shrink_many mm/vmscan.c:4885 [inline]
 lru_gen_shrink_node mm/vmscan.c:4963 [inline]
 shrink_node+0x451b/0x5170 mm/vmscan.c:5943
 shrink_zones mm/vmscan.c:6201 [inline]
 do_try_to_free_pages+0x820/0x2550 mm/vmscan.c:6263
 try_to_free_pages+0xbed/0x17c0 mm/vmscan.c:6513
 __perform_reclaim mm/page_alloc.c:3927 [inline]
 __alloc_pages_direct_reclaim+0x107/0x330 mm/page_alloc.c:3949
 __alloc_pages_slowpath+0x995/0x16e0 mm/page_alloc.c:4380
 __alloc_pages_noprof+0xa4c/0xe00 mm/page_alloc.c:4764
 alloc_pages_mpol_noprof+0x299/0x990 mm/mempolicy.c:2265
 alloc_pages_noprof+0x1bf/0x1e0 mm/mempolicy.c:2345
 vm_area_alloc_pages mm/vmalloc.c:3568 [inline]
 __vmalloc_area_node mm/vmalloc.c:3646 [inline]
 __vmalloc_node_range_noprof+0x1030/0x2740 mm/vmalloc.c:3828
 vmalloc_user_noprof+0x90/0xb0 mm/vmalloc.c:3982
 kcov_ioctl+0x5a/0x660 kernel/kcov.c:716
 __do_compat_sys_ioctl fs/ioctl.c:1004 [inline]
 __se_compat_sys_ioctl+0x80f/0x1020 fs/ioctl.c:947
 __ia32_compat_sys_ioctl+0x93/0xe0 fs/ioctl.c:947
 ia32_sys_call+0x2226/0x4180 arch/x86/include/generated/asm/syscalls_32.h:55
 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
 __do_fast_syscall_32+0xb0/0x110 arch/x86/entry/common.c:386
 do_fast_syscall_32+0x38/0x80 arch/x86/entry/common.c:411
 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:449
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e

CPU: 0 UID: 0 PID: 5784 Comm: syz-executor Not tainted 6.12.0-syzkaller-03657-g43fb83c17ba2 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024
=====================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/11/21 12:03 upstream 43fb83c17ba2 4b25d554 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in sw842_decompress
* Struck through repros no longer work on HEAD.