syzbot


KMSAN: uninit-value in rcu_accelerate_cbs

Status: closed as invalid on 2018/07/20 11:18
Subsystems: kernel
[Documentation on labels]
First crash: 2678d, last: 2638d

Sample crash report:
==================================================================
BUG: KMSAN: uninit-value in rcu_accelerate_cbs+0x15a/0xca0 kernel/rcu/tree.c:1810
CPU: 1 PID: 9 Comm: rcu_sched Not tainted 4.17.0+ #6
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x185/0x1d0 lib/dump_stack.c:113
 kmsan_report+0x188/0x2a0 mm/kmsan/kmsan.c:1117
 __msan_warning_32+0x70/0xc0 mm/kmsan/kmsan_instr.c:620
 rcu_accelerate_cbs+0x15a/0xca0 kernel/rcu/tree.c:1810
 rcu_advance_cbs kernel/rcu/tree.c:1860 [inline]
 __note_gp_changes+0x27b/0x950 kernel/rcu/tree.c:1887
 rcu_gp_cleanup kernel/rcu/tree.c:2148 [inline]
 rcu_gp_kthread+0x2fa9/0x38d0 kernel/rcu/tree.c:2280
 kthread+0x4db/0x6c0 kernel/kthread.c:241
 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:412

Uninit was stored to memory at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:279 [inline]
 kmsan_save_stack mm/kmsan/kmsan.c:294 [inline]
 kmsan_internal_chain_origin+0x12b/0x210 mm/kmsan/kmsan.c:685
 __msan_chain_origin+0x69/0xc0 mm/kmsan/kmsan_instr.c:464
 rcu_segcblist_enqueue+0x24c/0x2d0 kernel/rcu/rcu_segcblist.c:150
 __call_rcu+0x227/0xef0 kernel/rcu/tree.c:3057
 call_rcu_sched+0x32/0x40 kernel/rcu/tree.c:3097
 free_pid+0x441/0x450 kernel/pid.c:156
 __change_pid kernel/pid.c:294 [inline]
 detach_pid+0x35a/0x370 kernel/pid.c:299
 __unhash_process kernel/exit.c:75 [inline]
 __exit_signal kernel/exit.c:156 [inline]
 release_task+0x10a0/0x2530 kernel/exit.c:200
 exit_notify kernel/exit.c:736 [inline]
 do_exit+0x2e11/0x3930 kernel/exit.c:887
 do_group_exit+0x1a0/0x360 kernel/exit.c:970
 get_signal+0x1405/0x1ec0 kernel/signal.c:2482
 do_signal+0xb8/0x1d20 arch/x86/kernel/signal.c:810
 exit_to_usermode_loop arch/x86/entry/common.c:162 [inline]
 prepare_exit_to_usermode+0x271/0x3a0 arch/x86/entry/common.c:196
 syscall_return_slowpath+0xe9/0x710 arch/x86/entry/common.c:265
 do_syscall_64+0x1ad/0x230 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
Local variable description: ----tlb.i@ldt_arch_exit_mmap
Variable was created at:
 ldt_arch_exit_mmap+0x46/0x160 arch/x86/kernel/ldt.c:302
 arch_exit_mmap arch/x86/include/asm/mmu_context.h:245 [inline]
 exit_mmap+0x410/0x980 mm/mmap.c:3094
==================================================================

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/06/12 11:30 https://github.com/google/kmsan.git master 5cdf0501ac1b 112eec79 .config console log report ci-upstream-kmsan-gce
2018/05/30 17:39 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/05/04 01:08 https://github.com/google/kmsan.git master d2d741e5d189 9ce14f4b .config console log report ci-upstream-kmsan-gce
* Struck through repros no longer work on HEAD.