syzbot


KMSAN: uninit-value in sgi_partition

Status: closed as invalid on 2020/07/22 14:02
Subsystems: block
[Documentation on labels]
First crash: 1374d, last: 1374d

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in __arch_swab32 arch/x86/include/uapi/asm/swab.h:10 [inline]
BUG: KMSAN: uninit-value in __fswab32 include/uapi/linux/swab.h:60 [inline]
BUG: KMSAN: uninit-value in sgi_partition+0x230/0xab0 block/partitions/sgi.c:53
CPU: 0 PID: 9027 Comm: syz-executor.1 Not tainted 5.8.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1df/0x240 lib/dump_stack.c:118
 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:121
 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215
 __arch_swab32 arch/x86/include/uapi/asm/swab.h:10 [inline]
 __fswab32 include/uapi/linux/swab.h:60 [inline]
 sgi_partition+0x230/0xab0 block/partitions/sgi.c:53
 check_partition block/partitions/core.c:140 [inline]
 blk_add_partitions+0x8e3/0x2640 block/partitions/core.c:700
 bdev_disk_changed+0x5a1/0xa20 fs/block_dev.c:1524
 loop_reread_partitions drivers/block/loop.c:657 [inline]
 loop_set_status+0x12a1/0x1590 drivers/block/loop.c:1422
 lo_ioctl+0x205b/0x3750 drivers/block/loop.c:1532
 lo_compat_ioctl+0x3d7/0x500 drivers/block/loop.c:1873
 compat_blkdev_ioctl+0xadd/0x1060 block/ioctl.c:691
 __do_compat_sys_ioctl fs/ioctl.c:847 [inline]
 __se_compat_sys_ioctl+0x57c/0xed0 fs/ioctl.c:798
 __ia32_compat_sys_ioctl+0x4a/0x70 fs/ioctl.c:798
 do_syscall_32_irqs_on arch/x86/entry/common.c:430 [inline]
 __do_fast_syscall_32+0x2aa/0x400 arch/x86/entry/common.c:477
 do_fast_syscall_32+0x6b/0xd0 arch/x86/entry/common.c:505
 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:554
 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c
RIP: 0023:0xf7f05549
Code: Bad RIP value.
RSP: 002b:00000000f5cffeb8 EFLAGS: 00000292 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000004c04
RDX: 00000000f5cfff54 RSI: 00000000f5d00b28 RDI: 00000000f5cfff54
RBP: 000000000000000c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000

Uninit was stored to memory at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:144 [inline]
 kmsan_internal_chain_origin+0xad/0x130 mm/kmsan/kmsan.c:310
 kmsan_memcpy_memmove_metadata+0x272/0x2e0 mm/kmsan/kmsan.c:247
 kmsan_memcpy_metadata+0xb/0x10 mm/kmsan/kmsan.c:267
 __msan_memcpy+0x43/0x50 mm/kmsan/kmsan_instr.c:116
 memcpy_to_page lib/iov_iter.c:475 [inline]
 _copy_to_iter+0x1d89/0x26e0 lib/iov_iter.c:631
 copy_to_iter include/linux/uio.h:138 [inline]
 copy_page_to_iter+0x40c/0x1bb0 lib/iov_iter.c:918
 shmem_file_read_iter+0xa29/0x1160 mm/shmem.c:2587
 do_iter_readv_writev+0x94a/0xb10 include/linux/fs.h:1902
 do_iter_read+0x2ea/0xdb0 fs/read_write.c:953
 vfs_iter_read+0x118/0x180 fs/read_write.c:995
 lo_read_simple drivers/block/loop.c:363 [inline]
 do_req_filebacked drivers/block/loop.c:638 [inline]
 loop_handle_cmd drivers/block/loop.c:2043 [inline]
 loop_queue_work+0x34da/0x41d0 drivers/block/loop.c:2060
 kthread_worker_fn+0x5a7/0x910 kernel/kthread.c:709
 loop_kthread_worker_fn+0x90/0xb0 drivers/block/loop.c:933
 kthread+0x515/0x550 kernel/kthread.c:292
 ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:293

Uninit was stored to memory at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:144 [inline]
 kmsan_internal_chain_origin+0xad/0x130 mm/kmsan/kmsan.c:310
 kmsan_memcpy_memmove_metadata+0x272/0x2e0 mm/kmsan/kmsan.c:247
 kmsan_memcpy_metadata+0xb/0x10 mm/kmsan/kmsan.c:267
 __msan_memcpy+0x43/0x50 mm/kmsan/kmsan_instr.c:116
 memcpy_from_page lib/iov_iter.c:468 [inline]
 iov_iter_copy_from_user_atomic+0x11b1/0x1780 lib/iov_iter.c:1003
 generic_perform_write+0x499/0x9a0 mm/filemap.c:3326
 __generic_file_write_iter+0x44e/0xa50 mm/filemap.c:3447
 generic_file_write_iter+0x770/0xad0 mm/filemap.c:3479
 do_iter_readv_writev+0x94a/0xb10 include/linux/fs.h:1902
 do_iter_write+0x303/0xdc0 fs/read_write.c:1018
 vfs_iter_write+0x118/0x180 fs/read_write.c:1059
 iter_file_splice_write+0xb5f/0x1800 fs/splice.c:750
 do_splice_from fs/splice.c:846 [inline]
 direct_splice_actor+0x1fd/0x580 fs/splice.c:1016
 splice_direct_to_actor+0x6b2/0xf50 fs/splice.c:971
 do_splice_direct+0x342/0x580 fs/splice.c:1059
 do_sendfile+0x101b/0x1d40 fs/read_write.c:1540
 __do_compat_sys_sendfile fs/read_write.c:1622 [inline]
 __se_compat_sys_sendfile+0x301/0x3c0 fs/read_write.c:1605
 __ia32_compat_sys_sendfile+0x56/0x70 fs/read_write.c:1605
 do_syscall_32_irqs_on arch/x86/entry/common.c:430 [inline]
 __do_fast_syscall_32+0x2aa/0x400 arch/x86/entry/common.c:477
 do_fast_syscall_32+0x6b/0xd0 arch/x86/entry/common.c:505
 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:554
 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c

Uninit was created at:
 kmsan_save_stack_with_flags+0x3c/0x90 mm/kmsan/kmsan.c:144
 kmsan_internal_alloc_meta_for_pages mm/kmsan/kmsan_shadow.c:269 [inline]
 kmsan_alloc_page+0xb9/0x180 mm/kmsan/kmsan_shadow.c:293
 __alloc_pages_nodemask+0x56a2/0x5dc0 mm/page_alloc.c:4889
 alloc_pages_current+0x672/0x990 mm/mempolicy.c:2292
 alloc_pages include/linux/gfp.h:545 [inline]
 push_pipe+0x605/0xb70 lib/iov_iter.c:537
 __pipe_get_pages lib/iov_iter.c:1278 [inline]
 pipe_get_pages_alloc lib/iov_iter.c:1385 [inline]
 iov_iter_get_pages_alloc+0x18a9/0x21c0 lib/iov_iter.c:1403
 default_file_splice_read fs/splice.c:385 [inline]
 do_splice_to+0x4fc/0x14f0 fs/splice.c:871
 splice_direct_to_actor+0x45c/0xf50 fs/splice.c:950
 do_splice_direct+0x342/0x580 fs/splice.c:1059
 do_sendfile+0x101b/0x1d40 fs/read_write.c:1540
 __do_compat_sys_sendfile fs/read_write.c:1622 [inline]
 __se_compat_sys_sendfile+0x301/0x3c0 fs/read_write.c:1605
 __ia32_compat_sys_sendfile+0x56/0x70 fs/read_write.c:1605
 do_syscall_32_irqs_on arch/x86/entry/common.c:430 [inline]
 __do_fast_syscall_32+0x2aa/0x400 arch/x86/entry/common.c:477
 do_fast_syscall_32+0x6b/0xd0 arch/x86/entry/common.c:505
 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:554
 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c
=====================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/07/20 09:26 https://github.com/google/kmsan.git master 14525656779e 9c812472 .config console log report ci-upstream-kmsan-gce-386
* Struck through repros no longer work on HEAD.