syzbot


KMSAN: uninit-value in ___slab_alloc

Status: auto-closed as invalid on 2019/05/13 03:56
Subsystems: apparmor
[Documentation on labels]
First crash: 1990d, last: 1990d

Sample crash report:
==================================================================
BUG: KMSAN: uninit-value in new_slab_objects mm/slub.c:2469 [inline]
BUG: KMSAN: uninit-value in ___slab_alloc+0x929/0x1e40 mm/slub.c:2628
CPU: 1 PID: 9746 Comm: syz-executor1 Not tainted 4.20.0-rc2+ #85
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x32d/0x480 lib/dump_stack.c:113
 kmsan_report+0x19f/0x300 mm/kmsan/kmsan.c:911
 __msan_warning+0x76/0xc0 mm/kmsan/kmsan_instr.c:415
 new_slab_objects mm/slub.c:2469 [inline]
 ___slab_alloc+0x929/0x1e40 mm/slub.c:2628
 __slab_alloc mm/slub.c:2668 [inline]
 slab_alloc_node mm/slub.c:2731 [inline]
 slab_alloc mm/slub.c:2773 [inline]
 __kmalloc+0x44f/0x4d0 mm/slub.c:3819
 kmalloc include/linux/slab.h:551 [inline]
 kzalloc include/linux/slab.h:741 [inline]
 aa_alloc_task_ctx security/apparmor/include/task.h:47 [inline]
 apparmor_task_alloc+0x5f/0x300 security/apparmor/lsm.c:102
 security_task_alloc+0x107/0x1e0 security/security.c:1002
 copy_process+0x2dd9/0xc3c0 kernel/fork.c:1900
 _do_fork+0x3e3/0x1370 kernel/fork.c:2217
 __do_sys_clone kernel/fork.c:2324 [inline]
 __se_sys_clone+0xf6/0x110 kernel/fork.c:2318
 __x64_sys_clone+0x62/0x80 kernel/fork.c:2318
 do_syscall_64+0xcf/0x110 arch/x86/entry/common.c:291
 entry_SYSCALL_64_after_hwframe+0x63/0xe7
RIP: 0033:0x457569
Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f7cae31ac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000457569
RDX: 9999999999999999 RSI: SeaBIOS (version 1.8.2-20181014_101610-google)
Linux version 4.20.0-rc2+ (syzkaller@ci) (clang version 8.0.0 (trunk 343298)) #85 SMP Tue Nov 13 16:22:42 UTC 2018
Command line: BOOT_IMAGE=/vmlinuz root=/dev/sda1 console=ttyS0 earlyprintk=serial vsyscall=native rodata=n oops=panic panic_on_warn=1 nmi_watchdog=panic panic=86400 security=apparmor ima_policy=tcb workqueue.watchdog_thresh=140 kvm-intel.nested=1 nf-conntrack-ftp.ports=20000 nf-conntrack-tftp.ports=20000 nf-conntrack-sip.ports=20000 nf-conntrack-irc.ports=20000 nf-conntrack-sane.ports=20000 vivid.n_devs=16 vivid.multiplanar=1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2 nopcid
KERNEL supported cpus:
  Intel GenuineIntel
  AMD AuthenticAMD
  Hygon HygonGenuine
  Centaur CentaurHauls
x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'
x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'
x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers'
x86/fpu: xstate_offset[2]:  576, xstate_sizes[2]:  256
x86/fpu: Enabled xstate features 0x7, context size is 832 bytes, using 'standard' format.
BIOS-provided physical RAM map:
BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable
BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved
BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved
BIOS-e820: [mem 0x0000000000100000-0x00000000bfffcfff] usable
BIOS-e820: [mem 0x00000000bfffd000-0x00000000bfffffff] reserved
BIOS-e820: [mem 0x00000000fffbc000-0x00000000ffffffff] reserved
BIOS-e820: [mem 0x0000000100000000-0x000000021fffffff] usable
printk: bootconsole [earlyser0] enabled
Malformed early option 'vsyscall'
nopcid: PCID feature disabled
NX (Execute Disable) protection: active
SMBIOS 2.4 present.
DMI: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
last_pfn = 0x220000 max_arch_pfn = 0x400000000
x86/PAT: Configuration [0-7]: WB  WC  UC- UC  WB  WP  UC- WT  
last_pfn = 0xbfffd max_arch_pfn = 0x400000000
found SMP MP-table at [mem 0x000f2c80-0x000f2c8f] mapped at [(____ptrval____)]
check: Scanning 1 areas for low memory corruption
Using GB pages for direct mapping
ACPI: Early table checksum verification disabled
ACPI: RSDP 0x00000000000F2A50 000014 (v00 Google)
ACPI: RSDT 0x00000000BFFFDBA0 000038 (v01 Google GOOGRSDT 00000001 GOOG 00000001)
ACPI: FACP 0x00000000BFFFFF00 0000F4 (v02 Google GOOGFACP 00000001 GOOG 00000001)
ACPI: DSDT 0x00000000BFFFDBE0 0017B2 (v01 Google GOOGDSDT 00000001 GOOG 00000001)
ACPI: FACS 0x00000000BFFFFEC0 000040
ACPI: FACS 0x00000000BFFFFEC0 000040
ACPI: SSDT 0x00000000BFFFF590 000930 (v01 Google GOOGSSDT 00000001 GOOG 00000001)
ACPI: APIC 0x00000000BFFFF4A0 000076 (v01 Google GOOGAPIC 00000001 GOOG 00000001)
ACPI: WAET 0x00000000BFFFF470 000028 (v01 Google GOOGWAET 00000001 GOOG 00000001)
ACPI: SRAT 0x00000000BFFFF3A0 0000C8 (v01 Google GOOGSRAT 00000001 GOOG 00000001)
SRAT: PXM 0 -> APIC 0x00 -> Node 0
SRAT: PXM 0 -> APIC 0x01 -> Node 0
ACPI: SRAT: Node 0 PXM 0 [mem 0x00000000-0x0009ffff]
ACPI: SRAT: Node 0 PXM 0 [mem 0x00100000-0xbfffffff]
ACPI: SRAT: Node 0 PXM 0 [mem 0x100000000-0x21fffffff]
NUMA: Node 0 [mem 0x00000000-0x0009ffff] + [mem 0x00100000-0xbfffffff] -> [mem 0x00000000-0xbfffffff]
NUMA: Node 0 [mem 0x00000000-0xbfffffff] + [mem 0x100000000-0x21fffffff] -> [mem 0x00000000-0x21fffffff]
NODE_DATA(0) allocated [mem 0x21fffa000-0x21fffdfff]
Zone ranges:
  DMA      [mem 0x0000000000001000-0x0000000000ffffff]
  DMA32    [mem 0x0000000001000000-0x00000000ffffffff]
  Normal   [mem 0x0000000100000000-0x000000021fffffff]
Movable zone start for each node
Early memory node ranges
  node   0: [mem 0x0000000000001000-0x000000000009efff]
  node   0: [mem 0x0000000000100000-0x00000000bfffcfff]
  node   0: [mem 0x0000000100000000-0x000000021fffffff]
Zeroed struct page in unavailable ranges: 101 pages
Initmem setup node 0 [mem 0x0000000000001000-0x000000021fffffff]
ACPI: PM-Timer IO Port: 0xb008
ACPI: LAPIC_NMI (acpi_id[0xff] dfl dfl lint[0x1])
IOAPIC[0]: apic_id 0, version 17, address 0xfec00000, GSI 0-23
ACPI: INT_SRC_OVR (bus 0 bus_irq 5 global_irq 5 high level)
ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 high level)
ACPI: INT_SRC_OVR (bus 0 bus_irq 10 global_irq 10 high level)
ACPI: INT_SRC_OVR (bus 0 bus_irq 11 global_irq 11 high level)
Using ACPI (MADT) for SMP configuration information
smpboot: Allowing 2 CPUs, 0 hotplug CPUs
PM: Registered nosave memory: [mem 0x00000000-0x00000fff]
PM: Registered nosave memory: [mem 0x0009f000-0x0009ffff]
PM: Registered nosave memory: [mem 0x000a0000-0x000effff]
PM: Registered nosave memory: [mem 0x000f0000-0x000fffff]
PM: Registered nosave memory: [mem 0xbfffd000-0xbfffffff]
PM: Registered nosave memory: [mem 0xc0000000-0xfffbbfff]
PM: Registered nosave memory: [mem 0xfffbc000-0xffffffff]
[mem 0xc0000000-0xfffbbfff] available for PCI devices
clocksource: refined-jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
random: get_random_bytes called from boot_init_stack_canary arch/x86/include/asm/stackprotector.h:75 [inline] with crng_init=0
random: get_random_bytes called from start_kernel+0x19f/0xc5a init/main.c:566 with crng_init=0
setup_percpu: NR_CPUS:64 nr_cpumask_bits:64 nr_cpu_ids:2 nr_node_ids:1
setup_percpu: pcpu_fc_alloc(0, 0000000000200000, 0000000000200000)=ffff88821fc00000
percpu: Embedded 195 pages/cpu @(____ptrval____) s757768 r8192 d32760 u1048576
Built 1 zonelists, mobility grouping on.  Total pages: 1919877
Policy zone: Normal
Kernel command line: BOOT_IMAGE=/vmlinuz root=/dev/sda1 console=ttyS0 earlyprintk=serial vsyscall=native rodata=n oops=panic panic_on_warn=1 nmi_watchdog=panic panic=86400 security=apparmor ima_policy=tcb workqueue.watchdog_thresh=140 kvm-intel.nested=1 nf-conntrack-ftp.ports=20000 nf-conntrack-tftp.ports=20000 nf-conntrack-sip.ports=20000 nf-conntrack-irc.ports=20000 nf-conntrack-sane.ports=20000 vivid.n_devs=16 vivid.multiplanar=1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2 nopcid

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/11/14 03:43 https://github.com/google/kmsan.git master 006aa39cddee 5f5f6d14 .config console log report ci-upstream-kmsan-gce
* Struck through repros no longer work on HEAD.