syzbot


KMSAN: kernel-infoleak in sys_name_to_handle_at (2)

Status: upstream: reported on 2023/04/03 06:23
Labels: fs (incorrect?)
Reported-by: syzbot+fbc7d315ac68168b2bd6@syzkaller.appspotmail.com
First crash: 73d, last: 4d14h
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [fs?] KMSAN: kernel-infoleak in sys_name_to_handle_at (2) 0 (1) 2023/04/03 06:23
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: kernel-infoleak in sys_name_to_handle_at fs 2 167d 161d 0/24 auto-obsoleted due to no activity on 2023/03/17 17:26

Sample crash report:
loop1: detected capacity change from 0 to 256
=====================================================
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
BUG: KMSAN: kernel-infoleak in _copy_to_user+0xbc/0x100 lib/usercopy.c:40
 instrument_copy_to_user include/linux/instrumented.h:114 [inline]
 _copy_to_user+0xbc/0x100 lib/usercopy.c:40
 copy_to_user include/linux/uaccess.h:191 [inline]
 do_sys_name_to_handle fs/fhandle.c:73 [inline]
 __do_sys_name_to_handle_at fs/fhandle.c:109 [inline]
 __se_sys_name_to_handle_at+0x7be/0x8f0 fs/fhandle.c:93
 __ia32_sys_name_to_handle_at+0xe3/0x150 fs/fhandle.c:93
 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
 __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178
 do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203
 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246
 entry_SYSENTER_compat_after_hwframe+0x70/0x82

Uninit was created at:
 slab_post_alloc_hook+0x12d/0xb60 mm/slab.h:716
 slab_alloc_node mm/slub.c:3451 [inline]
 __kmem_cache_alloc_node+0x4ff/0x8b0 mm/slub.c:3490
 __do_kmalloc_node mm/slab_common.c:965 [inline]
 __kmalloc+0x121/0x3c0 mm/slab_common.c:979
 kmalloc include/linux/slab.h:563 [inline]
 do_sys_name_to_handle fs/fhandle.c:40 [inline]
 __do_sys_name_to_handle_at fs/fhandle.c:109 [inline]
 __se_sys_name_to_handle_at+0x39b/0x8f0 fs/fhandle.c:93
 __ia32_sys_name_to_handle_at+0xe3/0x150 fs/fhandle.c:93
 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
 __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178
 do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203
 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246
 entry_SYSENTER_compat_after_hwframe+0x70/0x82

Bytes 18-19 of 20 are uninitialized
Memory access of size 20 starts at ffff8880ac986b80
Data copied to user address 0000000020000040

CPU: 0 PID: 7614 Comm: syz-executor.1 Not tainted 6.4.0-rc3-syzkaller-gf93f2feda5d6 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023
=====================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Manager Title
2023/05/29 08:57 https://github.com/google/kmsan.git master f93f2feda5d6 cf184559 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386 KMSAN: kernel-infoleak in sys_name_to_handle_at
2023/03/21 07:48 https://github.com/google/kmsan.git master 90ea0df61c98 7939252e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386 KMSAN: kernel-infoleak in sys_name_to_handle_at
* Struck through repros no longer work on HEAD.