syzbot


KMSAN: uninit-value in _copy_to_user

Status: closed as invalid on 2018/07/20 09:18
Subsystems: fs
[Documentation on labels]
First crash: 2427d, last: 2402d

Sample crash report:
RDX: 0000000000000008 RSI: 0000000020000040 RDI: 0000000000000000
RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000014
R13: 00000000004c0137 R14: 00000000004cf730 R15: 0000000000000001
==================================================================
BUG: KMSAN: uninit-value in _copy_to_user+0x12f/0x180 lib/usercopy.c:26
CPU: 1 PID: 4451 Comm: rsyslogd Not tainted 4.17.0+ #16
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x185/0x1d0 lib/dump_stack.c:113
 kmsan_report+0x188/0x2a0 mm/kmsan/kmsan.c:1352
 __msan_warning_32+0x70/0xc0 mm/kmsan/kmsan_instr.c:634
 _copy_to_user+0x12f/0x180 lib/usercopy.c:26
 copy_to_user include/linux/uaccess.h:183 [inline]
 syslog_print kernel/printk/printk.c:1344 [inline]
 do_syslog+0x3936/0x3c20 kernel/printk/printk.c:1467
 kmsg_read+0x142/0x1a0 fs/proc/kmsg.c:40
 proc_reg_read+0x1e3/0x2f0 fs/proc/inode.c:230
 __vfs_read+0x1b2/0x9d0 fs/read_write.c:416
 vfs_read+0x36c/0x6b0 fs/read_write.c:452
 ksys_read fs/read_write.c:578 [inline]
 __do_sys_read fs/read_write.c:588 [inline]
 __se_sys_read fs/read_write.c:586 [inline]
 __x64_sys_read+0x1bf/0x3e0 fs/read_write.c:586
 do_syscall_64+0x15b/0x230 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x63/0xe7
RIP: 0033:0x7fdbad71b1fd
RSP: 002b:00007fdbaacbae30 EFLAGS: 00000293 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 0000000001b49ce0 RCX: 00007fdbad71b1fd
RDX: 0000000000000fff RSI: 00007fdbac4ef5a0 RDI: 0000000000000004
RBP: 0000000000000000 R08: 0000000001b35260 R09: 0000000004000001
R10: 0000000000000001 R11: 0000000000000293 R12: 000000000065e420
R13: 00007fdbaacbb9c0 R14: 00007fdbadd60040 R15: 0000000000000003

Uninit was stored to memory at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:287 [inline]
 kmsan_save_stack mm/kmsan/kmsan.c:302 [inline]
 kmsan_internal_chain_origin+0x12b/0x210 mm/kmsan/kmsan.c:692
 __msan_chain_origin+0x69/0xc0 mm/kmsan/kmsan_instr.c:478
 log_store+0x13fc/0x14b0 kernel/printk/printk.c:641
 log_output kernel/printk/printk.c:1832 [inline]
 vprintk_emit+0xca5/0x1060 kernel/printk/printk.c:1897
 vprintk_default+0x90/0xa0 kernel/printk/printk.c:1955
 vprintk_func+0x517/0x700 kernel/printk/printk_safe.c:379
 printk+0x1e4/0x210 kernel/printk/printk.c:1991
 printk_stack_address arch/x86/kernel/dumpstack.c:69 [inline]
 show_trace_log_lvl+0xb5c/0x10a0 arch/x86/kernel/dumpstack.c:207
 show_stack+0xfc/0x150 arch/x86/kernel/dumpstack.c:245
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x185/0x1d0 lib/dump_stack.c:113
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail+0x87b/0xab0 lib/fault-inject.c:149
 should_fail_futex kernel/futex.c:306 [inline]
 get_futex_key+0x355/0x1ce0 kernel/futex.c:519
 futex_wake+0x189/0xba0 kernel/futex.c:1526
 do_futex+0xaa8/0x6c20 kernel/futex.c:3531
 mm_release+0x297/0x600 kernel/fork.c:1203
 exit_mm+0xcb/0x7a0 kernel/exit.c:500
 do_exit+0xc12/0x3930 kernel/exit.c:854
 do_group_exit+0x1a0/0x360 kernel/exit.c:970
 get_signal+0x1405/0x1ec0 kernel/signal.c:2482
 do_signal+0xb8/0x1d20 arch/x86/kernel/signal.c:810
 exit_to_usermode_loop arch/x86/entry/common.c:162 [inline]
 prepare_exit_to_usermode+0x271/0x3a0 arch/x86/entry/common.c:196
 syscall_return_slowpath+0xe9/0x710 arch/x86/entry/common.c:265
 do_syscall_64+0x1ad/0x230 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x63/0xe7

Local variable description: ----timeout@futex_wait
Variable was created at:
 futex_wait+0xde/0xc20 kernel/futex.c:2613
 do_futex+0xcac/0x6c20 kernel/futex.c:3527
==================================================================

Crashes (8):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/07/02 18:12 https://github.com/google/kmsan.git master 6c3632ffef26 574780b0 .config console log report ci-upstream-kmsan-gce
2018/06/28 04:26 https://github.com/google/kmsan.git master 123906095e30 43e60f7e .config console log report ci-upstream-kmsan-gce
2018/06/27 08:58 https://github.com/google/kmsan.git master 123906095e30 43e60f7e .config console log report ci-upstream-kmsan-gce
2018/06/26 08:22 https://github.com/google/kmsan.git master 123906095e30 2064fc5c .config console log report ci-upstream-kmsan-gce
2018/06/21 19:32 https://github.com/google/kmsan.git master 123906095e30 095ef806 .config console log report ci-upstream-kmsan-gce
2018/06/18 17:35 https://github.com/google/kmsan.git master 123906095e30 27c5f59f .config console log report ci-upstream-kmsan-gce
2018/06/15 05:21 https://github.com/google/kmsan.git master 88e0e95b30f1 27c5f59f .config console log report ci-upstream-kmsan-gce
2018/06/07 07:58 https://github.com/google/kmsan.git master b9a5d319699c e0e534c6 .config console log report ci-upstream-kmsan-gce
* Struck through repros no longer work on HEAD.