syzbot


KMSAN: uninit-value in update_stack_state (2)

Status: auto-closed as invalid on 2019/06/02 23:19
Subsystems: kernel
[Documentation on labels]
First crash: 1969d, last: 1969d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in update_stack_state (4) rds C 1927 1317d 1373d 0/26 auto-obsoleted due to no activity on 2022/12/10 23:36
upstream KMSAN: uninit-value in update_stack_state fs C 103 2196d 2211d 0/26 closed as invalid on 2018/06/27 15:08
upstream KMSAN: uninit-value in update_stack_state (3) kernel C 132 1373d 1378d 0/26 closed as invalid on 2020/07/22 14:22

Sample crash report:
syz-executor1 (9689) used greatest stack depth: 52896 bytes left
==================================================================
BUG: KMSAN: uninit-value in update_stack_state+0x9e5/0xaa0 arch/x86/kernel/unwind_frame.c:266
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.20.0-rc3+ #104
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x32d/0x480 lib/dump_stack.c:113
 kmsan_report+0x12c/0x290 mm/kmsan/kmsan.c:683
 __msan_warning+0x76/0xc0 mm/kmsan/kmsan_instr.c:316
 update_stack_state+0x9e5/0xaa0 arch/x86/kernel/unwind_frame.c:266
 unwind_next_frame+0x64c/0xed0 arch/x86/kernel/unwind_frame.c:329
 __save_stack_trace+0x357/0x5d0 arch/x86/kernel/stacktrace.c:47
 save_stack_trace+0xc6/0x110 arch/x86/kernel/stacktrace.c:63
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:246 [inline]
 kmsan_save_stack mm/kmsan/kmsan.c:261 [inline]
 kmsan_internal_chain_origin+0x162/0x260 mm/kmsan/kmsan.c:469
 kmsan_memcpy_memmove_metadata+0x1a9/0xf70 mm/kmsan/kmsan.c:344
 kmsan_memcpy_metadata+0xb/0x10 mm/kmsan/kmsan.c:362
 __msan_memcpy+0x61/0x70 mm/kmsan/kmsan_instr.c:148
 chacha20_block+0x99/0x17d0 lib/chacha20.c:25
 _extract_crng+0x5f3/0x7f0 drivers/char/random.c:987
 crng_reseed+0x169/0x15a0 drivers/char/random.c:938
 _extract_crng+0x1c2/0x7f0 drivers/char/random.c:983
 extract_crng drivers/char/random.c:1004 [inline]
 _get_random_bytes+0x669/0x6f0 drivers/char/random.c:1637
 get_random_bytes+0xe2/0x2a0 drivers/char/random.c:1650
 __prandom_timer+0x5e/0x610 lib/random32.c:225
 call_timer_fn+0x356/0x7c0 kernel/time/timer.c:1326
 expire_timers kernel/time/timer.c:1363 [inline]
 __run_timers+0xe95/0x1300 kernel/time/timer.c:1682
 run_timer_softirq+0x55/0xa0 kernel/time/timer.c:1695
 __do_softirq+0x721/0xc7f kernel/softirq.c:293
 invoke_softirq kernel/softirq.c:375 [inline]
 irq_exit+0x305/0x340 kernel/softirq.c:416
 scheduler_ipi+0x172/0x250 kernel/sched/core.c:1787
 smp_reschedule_interrupt+0x1b8/0x670 arch/x86/kernel/smp.c:278
 reschedule_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:833
 </IRQ>
RIP: 0010:native_safe_halt arch/x86/include/asm/irqflags.h:57 [inline]
RIP: 0010:arch_safe_halt arch/x86/include/asm/irqflags.h:99 [inline]
RIP: 0010:default_idle+0x3f/0x80 arch/x86/kernel/process.c:498
Code: 04 00 00 00 e8 32 86 10 f7 65 8b 34 25 20 a1 02 00 c7 03 00 00 00 00 c7 43 08 00 00 00 00 bf 01 00 00 00 e8 f3 84 48 f6 fb f4 <48> c7 c7 20 a1 02 00 be 04 00 00 00 e8 00 86 10 f7 65 8b 34 25 20
RSP: 0018:ffff8881d0f1fe18 EFLAGS: 00000292 ORIG_RAX: ffffffffffffff02
RAX: 5c605d83ca6c1300 RBX: ffff8881d0ec8988 RCX: 0000000000000000
RDX: ffff8881fbb686c8 RSI: 0000160000000000 RDI: 0000000000000000
RBP: ffff8881d0f1fe20 R08: ffff888000000000 R09: 0000000000000002
R10: 0000000000000000 R11: ffffffff8af8dc40 R12: ffff8881d0ec8000
R13: 0000000000000001 R14: ffff8881d0ec8988 R15: ffff8881d0f1fe78
 arch_cpu_idle+0x26/0x30 arch/x86/kernel/process.c:489
 default_idle_call kernel/sched/idle.c:93 [inline]
 cpuidle_idle_call kernel/sched/idle.c:153 [inline]
 do_idle+0x3e4/0x9b0 kernel/sched/idle.c:262
 cpu_startup_entry+0x45/0x50 kernel/sched/idle.c:353
 start_secondary+0x57b/0x6a0 arch/x86/kernel/smpboot.c:271
 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:243

Local variable description: ----v.addr.i.i.i.i@tsc_verify_tsc_adjust
Variable was created at:
 tsc_verify_tsc_adjust+0x62/0x5d0 arch/x86/kernel/tsc_sync.c:48
 arch_cpu_idle_enter+0x13/0x20 arch/x86/kernel/process.c:475
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/12/04 21:54 https://github.com/google/kmsan.git master 00f99f811392 6ad0ae61 .config console log report ci-upstream-kmsan-gce
2018/12/04 13:18 https://github.com/google/kmsan.git master 00f99f811392 6ad0ae61 .config console log report ci-upstream-kmsan-gce
* Struck through repros no longer work on HEAD.