syzbot


KMSAN: uninit-value in snd_seq_control_queue

Status: auto-closed as invalid on 2019/08/31 06:57
Subsystems: sound
[Documentation on labels]
First crash: 1878d, last: 1878d

Sample crash report:
==================================================================
BUG: KMSAN: uninit-value in queueptr sound/core/seq/seq_queue.c:221 [inline]
BUG: KMSAN: uninit-value in snd_seq_control_queue+0x1a1/0x14d0 sound/core/seq/seq_queue.c:727
CPU: 1 PID: 13475 Comm: blkid Not tainted 5.0.0-rc1+ #9
Unknown ioctl 21533
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x173/0x1d0 lib/dump_stack.c:113
 kmsan_report+0x12e/0x2a0 mm/kmsan/kmsan.c:600
 __msan_warning+0x82/0xf0 mm/kmsan/kmsan_instr.c:313
 queueptr sound/core/seq/seq_queue.c:221 [inline]
 snd_seq_control_queue+0x1a1/0x14d0 sound/core/seq/seq_queue.c:727
 event_input_timer+0x8a/0xa0 sound/core/seq/seq_system.c:118
 snd_seq_deliver_single_event+0x8f9/0x11d0 sound/core/seq/seq_clientmgr.c:621
 snd_seq_deliver_event+0x42a/0xea0 sound/core/seq/seq_clientmgr.c:822
 snd_seq_dispatch_event+0x43c/0x860 sound/core/seq/seq_clientmgr.c:896
 snd_seq_check_queue+0x2be/0x7e0 sound/core/seq/seq_queue.c:275
 snd_seq_timer_interrupt+0x63a/0x7c0 sound/core/seq/seq_timer.c:173
 snd_timer_interrupt+0x1eaa/0x2420 sound/core/timer.c:855
 snd_hrtimer_callback+0x2b4/0x5e0 sound/core/hrtimer.c:64
 __run_hrtimer kernel/time/hrtimer.c:1389 [inline]
 __hrtimer_run_queues+0xbfc/0x15c0 kernel/time/hrtimer.c:1451
 hrtimer_interrupt+0x458/0x1380 kernel/time/hrtimer.c:1509
 local_apic_timer_interrupt+0x7c/0x260 arch/x86/kernel/apic/apic.c:1035
 smp_apic_timer_interrupt+0x3e/0x70 arch/x86/kernel/apic/apic.c:1062
 apic_timer_interrupt+0x2e/0x40 arch/x86/entry/entry_64.S:814
 </IRQ>
RIP: 0010:__msan_chain_origin+0x93/0xe0 mm/kmsan/kmsan_instr.c:201
Code: 89 f7 e8 f0 e0 ff ff 89 c3 65 ff 0c 25 04 90 03 00 65 8b 04 25 04 90 03 00 85 c0 75 30 e8 f5 a2 3f ff 4c 89 7d d0 ff 75 d0 9d <65> 48 8b 04 25 28 00 00 00 48 3b 45 e0 75 0d 89 d8 48 83 c4 18 5b
RSP: 0018:ffff88808b59f6f0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000000 RBX: 00000000b38000bc RCX: 1cc2a10fbd660000
RDX: 0000000000000003 RSI: 0000000000480020 RDI: 00000000b620000c
RBP: ffff88808b59f720 R08: 0000000000000003 R09: ffff88808b59f4ac
R10: ffffffff8ae01788 R11: 0000000000000000 R12: ffff88808b59fcd0
R13: ffff88808b59fcc8 R14: 00000000b620000c R15: 0000000000000246
 step_into+0x70c/0x1b90 fs/namei.c:1778
 walk_component+0x1d0/0xba0 fs/namei.c:1829
 link_path_walk+0xa9e/0x2160 fs/namei.c:2135
 path_openat+0x1147/0x6b90 fs/namei.c:3533
 do_filp_open+0x2b8/0x710 fs/namei.c:3564
 do_sys_open+0x642/0xa30 fs/open.c:1063
 __do_sys_open fs/open.c:1081 [inline]
 __se_sys_open+0xad/0xc0 fs/open.c:1076
 __x64_sys_open+0x4a/0x70 fs/open.c:1076
 do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291
 entry_SYSCALL_64_after_hwframe+0x63/0xe7
RIP: 0033:0x7fc4602a8120
Code: 48 8b 15 1b 4d 2b 00 f7 d8 64 89 02 83 c8 ff c3 90 90 90 90 90 90 90 90 90 90 83 3d d5 a4 2b 00 00 75 10 b8 02 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 5e 8c 01 00 48 89 04 24
RSP: 002b:00007ffce7e27068 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 00007ffce7e280b0 RCX: 00007fc4602a8120
RDX: 00007ffce7e27082 RSI: 0000000000000000 RDI: 00007ffce7e27070
RBP: 0000000000000701 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffce7e29128
R13: 0000000000000000 R14: 00007fc460789820 R15: 00007fc46057f2a2

Uninit was created at:
 kmsan_save_stack_with_flags+0x7a/0x130 mm/kmsan/kmsan.c:205
 kmsan_internal_alloc_meta_for_pages+0x113/0x580 mm/kmsan/kmsan_hooks.c:98
 kmsan_alloc_page+0x7e/0x100 mm/kmsan/kmsan_hooks.c:396
 __alloc_pages_nodemask+0x137b/0x5e30 mm/page_alloc.c:4572
 alloc_pages_current+0x69d/0x9b0 mm/mempolicy.c:2106
 alloc_pages include/linux/gfp.h:511 [inline]
 __vmalloc_area_node mm/vmalloc.c:1693 [inline]
 __vmalloc_node_range+0x8d8/0x13a0 mm/vmalloc.c:1756
 __vmalloc_node mm/vmalloc.c:1801 [inline]
 __vmalloc_node_flags mm/vmalloc.c:1815 [inline]
 vmalloc+0xd8/0xf0 mm/vmalloc.c:1837
 snd_seq_pool_init+0xa3/0x7b0 sound/core/seq/seq_memory.c:392
 snd_seq_write+0x3a3/0xd50 sound/core/seq/seq_clientmgr.c:1023
 __vfs_write+0x1e2/0xc20 fs/read_write.c:485
 vfs_write+0x481/0x920 fs/read_write.c:549
 ksys_write fs/read_write.c:598 [inline]
 __do_sys_write fs/read_write.c:610 [inline]
 __se_sys_write+0x17a/0x370 fs/read_write.c:607
 __x64_sys_write+0x4a/0x70 fs/read_write.c:607
 do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291
 entry_SYSCALL_64_after_hwframe+0x63/0xe7
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/03/04 06:10 https://github.com/google/kmsan.git master fa1981bee40f 1c0e457a .config console log report ci-upstream-kmsan-gce
* Struck through repros no longer work on HEAD.