KMSAN: uninit-value in reiserfs_new_inode

Status: auto-closed as invalid on 2021/10/20 16:24
Subsystems: fs
[Documentation on labels]
Reported-by: syzbot+2a318f14e5e6bb69b96b@syzkaller.appspotmail.com
First crash: 2019d, last: 1877d
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
KMSAN: uninit-value in reiserfs_new_inode 0 (1) 2021/02/01 09:07
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in reiserfs_new_inode (2) fs 7 syz, C 1339 922d 1357d 0/29 auto-obsoleted due to no activity on 2024/04/12 15:06

Sample crash report:
REISERFS (device loop3): Created .reiserfs_priv - reserved for xattr storage.
REISERFS error (device loop3): reiserfs-2025 reiserfs_cache_bitmap_metadata: bitmap block 17 is corrupted: first bit must be 1
REISERFS (device loop3): Remounting filesystem read-only
=====================================================
BUG: KMSAN: uninit-value in reiserfs_new_inode+0x207c/0x3c30 fs/reiserfs/inode.c:2058
CPU: 1 PID: 10263 Comm: syz-executor.3 Not tainted 5.12.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x24c/0x2e0 lib/dump_stack.c:120
 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:121
 __msan_warning+0x5c/0xa0 mm/kmsan/kmsan_instr.c:197
 reiserfs_new_inode+0x207c/0x3c30 fs/reiserfs/inode.c:2058
 reiserfs_create+0x8c1/0xf50 fs/reiserfs/namei.c:667
 xattr_create fs/reiserfs/xattr.c:69 [inline]
 xattr_lookup+0x4a5/0x6b0 fs/reiserfs/xattr.c:412
 reiserfs_xattr_set_handle+0x1eb/0x2ac0 fs/reiserfs/xattr.c:540
 reiserfs_xattr_set+0x84d/0x9f0 fs/reiserfs/xattr.c:640
 security_set+0x1af/0x210 fs/reiserfs/xattr_security.c:32
 __vfs_setxattr+0x947/0x9a0 fs/xattr.c:180
 __vfs_setxattr_noperm+0x3b8/0xcc0 fs/xattr.c:214
 __vfs_setxattr_locked+0x5fe/0x6a0 fs/xattr.c:274
 vfs_setxattr+0x45c/0x7f0 fs/xattr.c:300
 setxattr+0x422/0x7b0 fs/xattr.c:573
 path_setxattr+0x2f6/0x520 fs/xattr.c:593
 __do_sys_setxattr fs/xattr.c:609 [inline]
 __se_sys_setxattr+0xee/0x110 fs/xattr.c:605
 __ia32_sys_setxattr+0x62/0x80 fs/xattr.c:605
 do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline]
 __do_fast_syscall_32+0x127/0x180 arch/x86/entry/common.c:142
 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168
 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211
 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c
RIP: 0023:0xf7fd0549
Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
RSP: 002b:00000000f55ca5fc EFLAGS: 00000296 ORIG_RAX: 00000000000000e2
RAX: ffffffffffffffda RBX: 0000000020000040 RCX: 0000000020000080
RDX: 00000000200000c0 RSI: 0000000000000015 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000

Uninit was created at:
 kmsan_save_stack_with_flags+0x3c/0x90 mm/kmsan/kmsan.c:121
 kmsan_alloc_page+0xd0/0x1e0 mm/kmsan/kmsan_shadow.c:274
 __alloc_pages_nodemask+0x827/0xf90 mm/page_alloc.c:5044
 alloc_pages_current+0x7b6/0xb60 mm/mempolicy.c:2277
 alloc_pages include/linux/gfp.h:561 [inline]
 alloc_slab_page mm/slub.c:1653 [inline]
 allocate_slab+0x364/0x1260 mm/slub.c:1793
 new_slab mm/slub.c:1856 [inline]
 new_slab_objects mm/slub.c:2602 [inline]
 ___slab_alloc+0xd42/0x1930 mm/slub.c:2765
 __slab_alloc mm/slub.c:2805 [inline]
 slab_alloc_node mm/slub.c:2886 [inline]
 slab_alloc mm/slub.c:2931 [inline]
 kmem_cache_alloc+0xc68/0x1030 mm/slub.c:2936
 reiserfs_alloc_inode+0x5a/0x170 fs/reiserfs/super.c:642
 alloc_inode fs/inode.c:234 [inline]
 new_inode_pseudo+0xa7/0x580 fs/inode.c:928
 new_inode+0x5a/0x3d0 fs/inode.c:957
 reiserfs_mkdir+0x2ca/0x1450 fs/reiserfs/namei.c:812
 xattr_mkdir fs/reiserfs/xattr.c:76 [inline]
 open_xa_root fs/reiserfs/xattr.c:136 [inline]
 open_xa_dir+0xa4c/0xc40 fs/reiserfs/xattr.c:152
 xattr_lookup+0x92/0x6b0 fs/reiserfs/xattr.c:395
 reiserfs_xattr_set_handle+0x1eb/0x2ac0 fs/reiserfs/xattr.c:540
 reiserfs_xattr_set+0x84d/0x9f0 fs/reiserfs/xattr.c:640
 security_set+0x1af/0x210 fs/reiserfs/xattr_security.c:32
 __vfs_setxattr+0x947/0x9a0 fs/xattr.c:180
 __vfs_setxattr_noperm+0x3b8/0xcc0 fs/xattr.c:214
 __vfs_setxattr_locked+0x5fe/0x6a0 fs/xattr.c:274
 vfs_setxattr+0x45c/0x7f0 fs/xattr.c:300
 setxattr+0x422/0x7b0 fs/xattr.c:573
 path_setxattr+0x2f6/0x520 fs/xattr.c:593
 __do_sys_setxattr fs/xattr.c:609 [inline]
 __se_sys_setxattr+0xee/0x110 fs/xattr.c:605
 __ia32_sys_setxattr+0x62/0x80 fs/xattr.c:605
 do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline]
 __do_fast_syscall_32+0x127/0x180 arch/x86/entry/common.c:142
 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168
 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211
 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c
=====================================================

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/06/22 16:23 https://github.com/google/kmsan.git master 6a6a67f21dec aba2b2fb .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in reiserfs_new_inode
2021/05/15 01:37 https://github.com/google/kmsan.git master bdefec9ab855 8bdd5343 .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in reiserfs_new_inode
2021/02/07 06:24 https://github.com/google/kmsan.git master 73d62e81b476 0655e081 .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in reiserfs_new_inode
2021/01/31 22:12 https://github.com/google/kmsan.git master 73d62e81b476 fc9fd31e .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in reiserfs_new_inode
* Struck through repros no longer work on HEAD.