KMSAN: uninit-value in vfs_write

Status: fixed on 2023/06/08 14:41
Subsystems: fs
[Documentation on labels]
Reported-by: syzbot+c9bfd85eca611ebf5db1@syzkaller.appspotmail.com
Fix commit: 2b4c99f7d9a5 can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write
First crash: 1285d, last: 1269d
▶ ▼ Discussions (3)
Title Replies (including bot) Last reply
[PATCH net 0/2] pull-request: can 2023-03-27 4 (4) 2023/03/28 02:50
[PATCH] FS, NET: Fix KMSAN uninit-value in vfs_write 7 (7) 2023/03/24 17:33
[syzbot] [fs?] KMSAN: uninit-value in vfs_write 0 (1) 2023/03/07 09:40
▶ ▼ Last patch testing requests (5)
Created Duration User Patch Repo Result
2023/03/14 11:36 23m ivan.orlov0322@gmail.com patch https://github.com/google/kmsan.git master OK log
2023/03/14 10:15 22m ivan.orlov0322@gmail.com patch https://github.com/google/kmsan.git master OK log
2023/03/14 10:14 0m ivan.orlov0322@gmail.com patch https://github.com/google/kmsan.git master error
2023/03/13 13:36 14m ivan.orlov0322@gmail.com patch https://github.com/google/kmsan.git master report log
2023/03/13 13:34 26m ivan.orlov0322@gmail.com patch https://github.com/google/kmsan.git master report log

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in aio_rw_done fs/aio.c:1520 [inline]
BUG: KMSAN: uninit-value in aio_write+0x899/0x950 fs/aio.c:1600
 aio_rw_done fs/aio.c:1520 [inline]
 aio_write+0x899/0x950 fs/aio.c:1600
 io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019
 __do_sys_io_submit fs/aio.c:2078 [inline]
 __se_sys_io_submit+0x293/0x770 fs/aio.c:2048
 __x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Uninit was created at:
 slab_post_alloc_hook mm/slab.h:766 [inline]
 slab_alloc_node mm/slub.c:3452 [inline]
 __kmem_cache_alloc_node+0x71f/0xce0 mm/slub.c:3491
 __do_kmalloc_node mm/slab_common.c:967 [inline]
 __kmalloc+0x11d/0x3b0 mm/slab_common.c:981
 kmalloc_array include/linux/slab.h:636 [inline]
 bcm_tx_setup+0x80e/0x29d0 net/can/bcm.c:930
 bcm_sendmsg+0x3a2/0xce0 net/can/bcm.c:1351
 sock_sendmsg_nosec net/socket.c:714 [inline]
 sock_sendmsg net/socket.c:734 [inline]
 sock_write_iter+0x495/0x5e0 net/socket.c:1108
 call_write_iter include/linux/fs.h:2189 [inline]
 aio_write+0x63a/0x950 fs/aio.c:1600
 io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019
 __do_sys_io_submit fs/aio.c:2078 [inline]
 __se_sys_io_submit+0x293/0x770 fs/aio.c:2048
 __x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

CPU: 1 PID: 5034 Comm: syz-executor350 Not tainted 6.2.0-rc6-syzkaller-80422-geda666ff2276 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023
=====================================================

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/02/05 03:11 https://github.com/google/kmsan.git master eda666ff2276 be607b78 .config strace log report syz C ci-upstream-kmsan-gce KMSAN: uninit-value in aio_write
2023/01/19 05:18 https://github.com/google/kmsan.git master e919e2b1bc1c 42660d9e .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in vfs_write
2023/02/05 01:18 https://github.com/google/kmsan.git master eda666ff2276 be607b78 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in aio_write
* Struck through repros no longer work on HEAD.