KMSAN: kernel-infoleak in sys_name_to_handle_at (2)

Status: auto-obsoleted due to no activity on 2023/09/11 04:32
Subsystems: nfs
[Documentation on labels]
Reported-by: syzbot+fbc7d315ac68168b2bd6@syzkaller.appspotmail.com
First crash: 1263d, last: 1189d
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [fs?] KMSAN: kernel-infoleak in sys_name_to_handle_at (2) 0 (1) 2023/04/03 06:23
▶ ▼ Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: kernel-infoleak in sys_name_to_handle_at (3) nfs 9 1 1059d 1059d 0/29 closed as invalid on 2023/12/22 15:49
upstream KMSAN: kernel-infoleak in sys_name_to_handle_at nfs 9 2 1357d 1351d 0/29 auto-obsoleted due to no activity on 2023/03/17 17:26
upstream KMSAN: kernel-infoleak in sys_name_to_handle_at (4) nfs 9 syz, C 7 915d 964d 25/29 fixed on 2024/04/10 03:59
linux-5.15 Internal error in sys_name_to_handle_at origin:lts-only 2 syz, C error 175 41d 392d 0/3 upstream: reported C repro on 2025/08/08 15:52

Sample crash report:
WARNING: The mand mount option has been deprecated and
         and is ignored by this kernel. Remove the mand
         option from the mount to silence this warning.
=======================================================
=====================================================
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
BUG: KMSAN: kernel-infoleak in _copy_to_user+0xbc/0x100 lib/usercopy.c:40
 instrument_copy_to_user include/linux/instrumented.h:114 [inline]
 _copy_to_user+0xbc/0x100 lib/usercopy.c:40
 copy_to_user include/linux/uaccess.h:191 [inline]
 do_sys_name_to_handle fs/fhandle.c:73 [inline]
 __do_sys_name_to_handle_at fs/fhandle.c:109 [inline]
 __se_sys_name_to_handle_at+0x7be/0x8f0 fs/fhandle.c:93
 __ia32_sys_name_to_handle_at+0xe3/0x150 fs/fhandle.c:93
 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
 __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178
 do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203
 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246
 entry_SYSENTER_compat_after_hwframe+0x70/0x82

Uninit was created at:
 slab_post_alloc_hook+0x12d/0xb60 mm/slab.h:716
 slab_alloc_node mm/slub.c:3451 [inline]
 __kmem_cache_alloc_node+0x4ff/0x8b0 mm/slub.c:3490
 __do_kmalloc_node mm/slab_common.c:965 [inline]
 __kmalloc+0x121/0x3c0 mm/slab_common.c:979
 kmalloc include/linux/slab.h:563 [inline]
 do_sys_name_to_handle fs/fhandle.c:40 [inline]
 __do_sys_name_to_handle_at fs/fhandle.c:109 [inline]
 __se_sys_name_to_handle_at+0x39b/0x8f0 fs/fhandle.c:93
 __ia32_sys_name_to_handle_at+0xe3/0x150 fs/fhandle.c:93
 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
 __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178
 do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203
 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246
 entry_SYSENTER_compat_after_hwframe+0x70/0x82

Bytes 18-19 of 20 are uninitialized
Memory access of size 20 starts at ffff8880a6831a00
Data copied to user address 0000000020000100

CPU: 0 PID: 6629 Comm: syz-executor.5 Not tainted 6.4.0-rc4-syzkaller-g2741f1b02117 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023
=====================================================

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/06/03 04:32 https://github.com/google/kmsan.git master 2741f1b02117 a4ae4f42 .config console log report info ci-upstream-kmsan-gce-386 KMSAN: kernel-infoleak in sys_name_to_handle_at
2023/05/29 08:57 https://github.com/google/kmsan.git master f93f2feda5d6 cf184559 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386 KMSAN: kernel-infoleak in sys_name_to_handle_at
2023/03/21 07:48 https://github.com/google/kmsan.git master 90ea0df61c98 7939252e .config console log report info ci-upstream-kmsan-gce-386 KMSAN: kernel-infoleak in sys_name_to_handle_at
* Struck through repros no longer work on HEAD.