syzbot


KMSAN: uninit-value in kallsyms_lookup (2)

Status: closed as invalid on 2020/05/14 13:06
Subsystems: kernel
[Documentation on labels]
First crash: 1439d, last: 1417d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in kallsyms_lookup kernel C 69 2148d 2168d 0/26 closed as invalid on 2018/06/27 15:18
upstream KMSAN: uninit-value in kallsyms_lookup (4) kernel 2 1058d 1163d 0/26 auto-closed as invalid on 2021/08/03 21:49
upstream KMSAN: uninit-value in kallsyms_lookup (3) kernel 16 1274d 1380d 0/26 auto-closed as invalid on 2021/01/01 15:28

Sample crash report:
RAX: ffffffffffffffda RBX: 0000000000000015 RCX: 000000000045c6f7
RDX: 00007f99f6a35510 RSI: 000000004020ae46 RDI: 0000000000000004
RBP: 0000000020014000 R08: 00007f99f6a35070 R09: 000000000078bfa0
R10: 0000000000000005 R11: 0000000000000246 R12: 00000000fec00000
R13: 0000000000000004 R14: 00000000004cdffa R15: 00007f99f6a376d4
Uninit was stored to memory at:
=====================================================
BUG: KMSAN: uninit-value in is_kernel include/linux/kallsyms.h:41 [inline]
BUG: KMSAN: uninit-value in is_ksym_addr include/linux/kallsyms.h:49 [inline]
BUG: KMSAN: uninit-value in kallsyms_lookup+0x148/0x8e0 kernel/kallsyms.c:290
CPU: 1 PID: 29402 Comm: syz-executor.4 Not tainted 5.7.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c9/0x220 lib/dump_stack.c:118
 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118
 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215
 is_kernel include/linux/kallsyms.h:41 [inline]
 is_ksym_addr include/linux/kallsyms.h:49 [inline]
 kallsyms_lookup+0x148/0x8e0 kernel/kallsyms.c:290
 __sprint_symbol+0x140/0x590 kernel/kallsyms.c:363
 sprint_symbol+0x7c/0x90 kernel/kallsyms.c:394
 symbol_string+0x157/0x420 lib/vsprintf.c:961
 pointer+0x1560/0x1e40 lib/vsprintf.c:2188
 vsnprintf+0x1a2a/0x31b0 lib/vsprintf.c:2578
 vscnprintf+0xc2/0x180 lib/vsprintf.c:2677
 vprintk_store+0xef/0x11d0 kernel/printk/printk.c:1942
 vprintk_emit+0x2c0/0x8b0 kernel/printk/printk.c:2009
 vprintk_default+0x90/0xa0 kernel/printk/printk.c:2054
 vprintk_func+0x1ec/0x220 kernel/printk/printk_safe.c:385
 printk+0x18b/0x1d3 kernel/printk/printk.c:2087
 stack_trace_print+0x1b1/0x1f0 kernel/stacktrace.c:32
 kmsan_print_origin+0xf5/0x190 mm/kmsan/kmsan_report.c:52
 kmsan_internal_chain_origin+0x76/0x130 mm/kmsan/kmsan.c:302
 kmsan_memcpy_memmove_metadata+0x272/0x2e0 mm/kmsan/kmsan.c:247
 kmsan_memcpy_metadata+0xb/0x10 mm/kmsan/kmsan.c:267
 __msan_memcpy+0x43/0x50 mm/kmsan/kmsan_instr.c:116
 kvm_dup_memslots arch/x86/kvm/../../../virt/kvm/kvm_main.c:1103 [inline]
 kvm_set_memslot+0x260/0x1b90 arch/x86/kvm/../../../virt/kvm/kvm_main.c:1118
 __kvm_set_memory_region+0x1b3b/0x1dc0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:1300
 kvm_set_memory_region arch/x86/kvm/../../../virt/kvm/kvm_main.c:1321 [inline]
 kvm_vm_ioctl_set_memory_region arch/x86/kvm/../../../virt/kvm/kvm_main.c:1333 [inline]
 kvm_vm_ioctl+0x131c/0x4350 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3604
 vfs_ioctl fs/ioctl.c:47 [inline]
 ksys_ioctl fs/ioctl.c:771 [inline]
 __do_sys_ioctl fs/ioctl.c:780 [inline]
 __se_sys_ioctl+0x2e9/0x410 fs/ioctl.c:778
 __x64_sys_ioctl+0x4a/0x70 fs/ioctl.c:778
 do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:297
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45c6f7
Code: 48 83 c4 08 48 89 d8 5b 5d c3 66 0f 1f 84 00 00 00 00 00 48 89 e8 48 f7 d8 48 39 c3 0f 92 c0 eb 92 66 90 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 0d b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f99f6a35068 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000015 RCX: 000000000045c6f7
RDX: 00007f99f6a35510 RSI: 000000004020ae46 RDI: 0000000000000004
RBP: 0000000020014000 R08: 00007f99f6a35070 R09: 000000000078bfa0
R10: 0000000000000005 R11: 0000000000000246 R12: 00000000fec00000
R13: 0000000000000004 R14: 00000000004cdffa R15: 00007f99f6a376d4

Uninit was created at:
 kmsan_save_stack_with_flags+0x3c/0x90 mm/kmsan/kmsan.c:144
 kmsan_internal_alloc_meta_for_pages mm/kmsan/kmsan_shadow.c:280 [inline]
 kmsan_alloc_page+0xb9/0x180 mm/kmsan/kmsan_shadow.c:304
 __alloc_pages_nodemask+0x56a2/0x5dc0 mm/page_alloc.c:4848
 alloc_pages_current+0x67d/0x990 mm/mempolicy.c:2295
 alloc_pages include/linux/gfp.h:540 [inline]
 __vmalloc_area_node mm/vmalloc.c:2511 [inline]
 __vmalloc_node_range+0x839/0x11c0 mm/vmalloc.c:2575
 __vmalloc_node mm/vmalloc.c:2630 [inline]
 __vmalloc_node_flags_caller+0x150/0x160 mm/vmalloc.c:2652
 kvmalloc_node+0x38b/0x3c0 mm/util.c:583
 kvmalloc include/linux/mm.h:757 [inline]
 frame_vector_create+0xc3/0x210 mm/frame_vector.c:220
 vb2_create_framevec+0x91/0x270 drivers/media/common/videobuf2/videobuf2-memops.c:48
 vb2_vmalloc_get_userptr+0x18e/0x940 drivers/media/common/videobuf2/videobuf2-vmalloc.c:90
 __prepare_userptr drivers/media/common/videobuf2/videobuf2-core.c:1062 [inline]
 __buf_prepare+0x16f1/0x4930 drivers/media/common/videobuf2/videobuf2-core.c:1302
 vb2_core_qbuf+0x29d/0x2210 drivers/media/common/videobuf2/videobuf2-core.c:1597
 vb2_qbuf drivers/media/common/videobuf2/videobuf2-v4l2.c:769 [inline]
 vb2_ioctl_qbuf+0x48e/0x530 drivers/media/common/videobuf2/videobuf2-v4l2.c:988
 v4l_qbuf+0x175/0x1c0 drivers/media/v4l2-core/v4l2-ioctl.c:2002
 __video_do_ioctl+0x1409/0x1a70 drivers/media/v4l2-core/v4l2-ioctl.c:2930
 video_usercopy+0x100a/0x2b50 drivers/media/v4l2-core/v4l2-ioctl.c:3242
 video_ioctl2+0x9f/0xb0 drivers/media/v4l2-core/v4l2-ioctl.c:3279
 v4l2_ioctl+0x23f/0x270 drivers/media/v4l2-core/v4l2-dev.c:360
 vfs_ioctl fs/ioctl.c:47 [inline]
 ksys_ioctl fs/ioctl.c:771 [inline]
 __do_sys_ioctl fs/ioctl.c:780 [inline]
 __se_sys_ioctl+0x2e9/0x410 fs/ioctl.c:778
 __x64_sys_ioctl+0x4a/0x70 fs/ioctl.c:778
 do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:297
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
=====================================================

Crashes (23):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/05/12 10:40 https://github.com/google/kmsan.git master 14bcee29ad06 160c7698 .config console log report ci-upstream-kmsan-gce
2020/05/12 09:55 https://github.com/google/kmsan.git master 14bcee29ad06 160c7698 .config console log report ci-upstream-kmsan-gce
2020/05/12 08:37 https://github.com/google/kmsan.git master 14bcee29ad06 9eb09c40 .config console log report ci-upstream-kmsan-gce
2020/05/12 04:04 https://github.com/google/kmsan.git master 14bcee29ad06 9eb09c40 .config console log report ci-upstream-kmsan-gce
2020/05/11 23:09 https://github.com/google/kmsan.git master 14bcee29ad06 9eb09c40 .config console log report ci-upstream-kmsan-gce
2020/05/11 21:43 https://github.com/google/kmsan.git master 14bcee29ad06 9eb09c40 .config console log report ci-upstream-kmsan-gce
2020/05/11 21:08 https://github.com/google/kmsan.git master 14bcee29ad06 9eb09c40 .config console log report ci-upstream-kmsan-gce
2020/05/11 16:56 https://github.com/google/kmsan.git master 14bcee29ad06 f8f57555 .config console log report ci-upstream-kmsan-gce
2020/05/11 16:17 https://github.com/google/kmsan.git master 14bcee29ad06 f8f57555 .config console log report ci-upstream-kmsan-gce
2020/05/11 13:41 https://github.com/google/kmsan.git master 14bcee29ad06 f8f57555 .config console log report ci-upstream-kmsan-gce
2020/05/11 09:38 https://github.com/google/kmsan.git master 14bcee29ad06 f8f57555 .config console log report ci-upstream-kmsan-gce
2020/05/11 09:17 https://github.com/google/kmsan.git master 14bcee29ad06 f8f57555 .config console log report ci-upstream-kmsan-gce
2020/05/11 09:07 https://github.com/google/kmsan.git master 14bcee29ad06 f8f57555 .config console log report ci-upstream-kmsan-gce
2020/05/11 03:28 https://github.com/google/kmsan.git master 14bcee29ad06 8742a2b9 .config console log report ci-upstream-kmsan-gce
2020/05/11 03:20 https://github.com/google/kmsan.git master 14bcee29ad06 8742a2b9 .config console log report ci-upstream-kmsan-gce
2020/05/11 01:03 https://github.com/google/kmsan.git master 14bcee29ad06 8742a2b9 .config console log report ci-upstream-kmsan-gce
2020/05/10 14:17 https://github.com/google/kmsan.git master 14bcee29ad06 8742a2b9 .config console log report ci-upstream-kmsan-gce
2020/05/10 14:06 https://github.com/google/kmsan.git master 14bcee29ad06 8742a2b9 .config console log report ci-upstream-kmsan-gce
2020/05/10 11:19 https://github.com/google/kmsan.git master 14bcee29ad06 8742a2b9 .config console log report ci-upstream-kmsan-gce
2020/05/10 11:04 https://github.com/google/kmsan.git master 14bcee29ad06 8742a2b9 .config console log report ci-upstream-kmsan-gce
2020/05/09 15:25 https://github.com/google/kmsan.git master a7b0442ddfb0 88cb3e92 .config console log report ci-upstream-kmsan-gce-386
2020/05/05 00:15 https://github.com/google/kmsan.git master 21c44613a2fe 9941337c .config console log report ci-upstream-kmsan-gce-386
2020/04/20 01:12 https://github.com/google/kmsan.git master 5356842da2b5 9f7c6d12 .config console log report ci-upstream-kmsan-gce-386
* Struck through repros no longer work on HEAD.