syzbot

 sign-in | mailing list | source | docs
🐞 Open [1641]
≡ Subsystems
🐞 Fixed [6108]
🐞 Invalid [15307]
⬇ Missing Backports [171]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
💬 Send us feedback

KMSAN: kernel-infoleak in __keyctl_dh_compute

Status: closed as invalid on 2022/09/09 10:54
Subsystems: keyrings lsm
[Documentation on labels]
First crash: 1692d, last: 1641d

Sample crash report:
=====================================================
BUG: KMSAN: kernel-infoleak in kmsan_copy_to_user+0x81/0x90 mm/kmsan/kmsan_hooks.c:253
CPU: 1 PID: 8489 Comm: syz-executor112 Not tainted 5.8.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x21c/0x280 lib/dump_stack.c:118
 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:121
 kmsan_internal_check_memory+0x358/0x3d0 mm/kmsan/kmsan.c:457
 kmsan_copy_to_user+0x81/0x90 mm/kmsan/kmsan_hooks.c:253
 instrument_copy_to_user include/linux/instrumented.h:91 [inline]
 _copy_to_user+0x18e/0x260 lib/usercopy.c:39
 copy_to_user include/linux/uaccess.h:186 [inline]
 keyctl_dh_compute_kdf security/keys/dh.c:219 [inline]
 __keyctl_dh_compute+0x24ea/0x2fa0 security/keys/dh.c:386
 keyctl_dh_compute+0x234/0x280 security/keys/dh.c:422
 __do_sys_keyctl security/keys/keyctl.c:1973 [inline]
 __se_sys_keyctl+0x1181/0x1fe0 security/keys/keyctl.c:1869
 __x64_sys_keyctl+0x62/0x80 security/keys/keyctl.c:1869
 do_syscall_64+0xad/0x160 arch/x86/entry/common.c:386
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x440469
Code: Bad RIP value.
RSP: 002b:00007fffa5664a08 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440469
RDX: 0000000020000540 RSI: 0000000020000400 RDI: 0000000000000017
RBP: 00000000006ca018 R08: 0000000020000980 R09: 00000000004002c8
R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000401c70
R13: 0000000000401d00 R14: 0000000000000000 R15: 0000000000000000

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:144 [inline]
 kmsan_internal_poison_shadow+0x66/0xd0 mm/kmsan/kmsan.c:127
 kmsan_slab_alloc+0x8a/0xe0 mm/kmsan/kmsan_hooks.c:80
 slab_alloc_node mm/slub.c:2839 [inline]
 slab_alloc mm/slub.c:2848 [inline]
 __kmalloc+0x312/0x410 mm/slub.c:3911
 kmalloc include/linux/slab.h:560 [inline]
 keyctl_dh_compute_kdf security/keys/dh.c:208 [inline]
 __keyctl_dh_compute+0x1f82/0x2fa0 security/keys/dh.c:386
 keyctl_dh_compute+0x234/0x280 security/keys/dh.c:422
 __do_sys_keyctl security/keys/keyctl.c:1973 [inline]
 __se_sys_keyctl+0x1181/0x1fe0 security/keys/keyctl.c:1869
 __x64_sys_keyctl+0x62/0x80 security/keys/keyctl.c:1869
 do_syscall_64+0xad/0x160 arch/x86/entry/common.c:386
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Bytes 0-2 of 3 are uninitialized
Memory access of size 3 starts at ffff88810761ff90
Data copied to user address 0000000020000540
=====================================================

Crashes (213):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/08/20 17:31 https://github.com/google/kmsan.git master ce8056d1f79e ed282a3a .config console log report syz C ci-upstream-kmsan-gce
2020/08/13 07:35 https://github.com/google/kmsan.git master ce8056d1f79e bc15f7db .config console log report syz C ci-upstream-kmsan-gce
2020/09/28 12:47 https://github.com/google/kmsan.git master c5a13b33ec11 6bfdbe89 .config console log report info ci-upstream-kmsan-gce
2020/09/28 02:26 https://github.com/google/kmsan.git master c5a13b33ec11 5dd8aee8 .config console log report info ci-upstream-kmsan-gce
2020/09/27 18:25 https://github.com/google/kmsan.git master c5a13b33ec11 5dd8aee8 .config console log report info ci-upstream-kmsan-gce
2020/09/26 11:40 https://github.com/google/kmsan.git master c5a13b33ec11 4a006f63 .config console log report info ci-upstream-kmsan-gce
2020/09/25 19:48 https://github.com/google/kmsan.git master c5a13b33ec11 4a006f63 .config console log report info ci-upstream-kmsan-gce
2020/09/21 01:35 https://github.com/google/kmsan.git master c5a13b33ec11 9564d2e9 .config console log report info ci-upstream-kmsan-gce
2020/09/20 19:11 https://github.com/google/kmsan.git master c5a13b33ec11 9564d2e9 .config console log report info ci-upstream-kmsan-gce
2020/09/20 17:59 https://github.com/google/kmsan.git master c5a13b33ec11 9564d2e9 .config console log report info ci-upstream-kmsan-gce
2020/09/12 10:46 https://github.com/google/kmsan.git master 3b3ea6028136 79fb24e2 .config console log report ci-upstream-kmsan-gce
2020/09/12 08:14 https://github.com/google/kmsan.git master 3b3ea6028136 79fb24e2 .config console log report ci-upstream-kmsan-gce
2020/09/12 04:12 https://github.com/google/kmsan.git master 3b3ea6028136 79fb24e2 .config console log report ci-upstream-kmsan-gce
2020/09/11 19:18 https://github.com/google/kmsan.git master 3b3ea6028136 adfb8b4e .config console log report ci-upstream-kmsan-gce
2020/09/10 12:21 https://github.com/google/kmsan.git master 3b3ea6028136 409809d8 .config console log report ci-upstream-kmsan-gce
2020/09/10 05:12 https://github.com/google/kmsan.git master 3b3ea6028136 409809d8 .config console log report ci-upstream-kmsan-gce
2020/09/09 19:39 https://github.com/google/kmsan.git master 3b3ea6028136 0ea7a887 .config console log report ci-upstream-kmsan-gce
2020/09/08 22:46 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce
2020/09/08 20:51 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce
2020/09/08 08:28 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce
2020/09/07 13:53 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce
2020/09/04 03:36 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce
2020/09/27 20:57 https://github.com/google/kmsan.git master c5a13b33ec11 5dd8aee8 .config console log report info ci-upstream-kmsan-gce-386
2020/09/26 21:12 https://github.com/google/kmsan.git master c5a13b33ec11 2d5ea0cb .config console log report info ci-upstream-kmsan-gce-386
2020/09/21 05:51 https://github.com/google/kmsan.git master c5a13b33ec11 9564d2e9 .config console log report info ci-upstream-kmsan-gce-386
2020/09/13 02:41 https://github.com/google/kmsan.git master 3b3ea6028136 ce441f06 .config console log report ci-upstream-kmsan-gce-386
2020/09/12 09:36 https://github.com/google/kmsan.git master 3b3ea6028136 79fb24e2 .config console log report ci-upstream-kmsan-gce-386
2020/09/10 22:50 https://github.com/google/kmsan.git master 3b3ea6028136 409809d8 .config console log report ci-upstream-kmsan-gce-386
2020/09/10 08:52 https://github.com/google/kmsan.git master 3b3ea6028136 409809d8 .config console log report ci-upstream-kmsan-gce-386
2020/09/09 08:23 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce-386
2020/09/09 02:51 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce-386
2020/09/08 13:58 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce-386
2020/09/08 10:34 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce-386
2020/09/07 21:14 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce-386
2020/09/07 19:54 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce-386
2020/09/07 16:27 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce-386
2020/09/07 15:07 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce-386
2020/09/07 07:33 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce-386
2020/09/07 05:25 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce-386
2020/09/07 01:35 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce-386
2020/09/06 07:13 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce-386
2020/09/05 23:30 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce-386
2020/09/05 21:07 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce-386
2020/09/04 19:36 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce-386
2020/09/04 01:59 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce-386
2020/09/03 21:43 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce-386
2020/08/08 20:39 https://github.com/google/kmsan.git master ce8056d1f79e f721e4a0 .config console log report ci-upstream-kmsan-gce-386
* Struck through repros no longer work on HEAD.