syzbot


KMSAN: uninit-value in exit_creds

Status: closed as invalid on 2019/10/08 12:18
Subsystems: usb
[Documentation on labels]
First crash: 1739d, last: 1739d

Sample crash report:
==================================================================
BUG: KMSAN: uninit-value in put_cred /./include/linux/cred.h:278 [inline]
BUG: KMSAN: uninit-value in exit_creds+0xb0/0x450 /kernel/cred.c:166
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.2.0+ #15
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack /lib/dump_stack.c:77 [inline]
 dump_stack+0x191/0x1f0 /lib/dump_stack.c:113
 kmsan_report+0x162/0x2d0 /mm/kmsan/kmsan_report.c:109
 __msan_warning+0x75/0xe0 /mm/kmsan/kmsan_instr.c:294
 put_cred /./include/linux/cred.h:278 [inline]
 exit_creds+0xb0/0x450 /kernel/cred.c:166
 __put_task_struct+0x12b/0x840 /kernel/fork.c:733
 put_task_struct /./include/linux/sched/task.h:99 [inline]
 delayed_put_task_struct+0x23b/0x270 /kernel/exit.c:183
 __rcu_reclaim /kernel/rcu/rcu.h:222 [inline]
 rcu_do_batch /kernel/rcu/tree.c:2092 [inline]
 invoke_rcu_callbacks /kernel/rcu/tree.c:2310 [inline]
 rcu_core+0xb45/0x1910 /kernel/rcu/tree.c:2291
 __do_softirq+0x4ad/0x858 /kernel/softirq.c:293
 invoke_softirq /kernel/softirq.c:375 [inline]
 irq_exit+0x238/0x290 /kernel/softirq.c:416
 exiting_irq+0xe/0x10 /./arch/x86/include/asm/apic.h:536
 smp_apic_timer_interrupt+0x48/0x70 /arch/x86/kernel/apic/apic.c:1070
 apic_timer_interrupt+0x2e/0x40 /arch/x86/entry/entry_64.S:813
 </IRQ>
RIP: 0010:default_idle+0x232/0x450 /arch/x86/kernel/process.c:581
Code: 37 f3 8b 1d 40 8c df 01 48 c7 c7 f0 f5 24 90 e8 f4 42 bb f3 83 38 00 0f 85 a4 01 00 00 85 db 7e 07 0f 00 2d 30 e3 5b 00 fb f4 <65> 8b 05 47 47 bd 71 89 45 c4 8b 1d 16 9e 7f 01 48 c7 c7 f8 07 c5
RSP: 0018:ffff8881280bfde0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: ffff888217c395f0 RBX: 0000000000000000 RCX: ffff888000000000
RDX: ffff888207e325f0 RSI: 0000160000000000 RDI: 00000000000005f0
RBP: ffff8881280bfe20 R08: 000000001024f5f0 R09: 0000778000000000
R10: ffffd0ffffffffff R11: 0000000000000004 R12: ffff888128090990
R13: 0000000000000000 R14: ffff888128090000 R15: ffff888128090990
 arch_cpu_idle+0x25/0x30 /arch/x86/kernel/process.c:571
 default_idle_call /kernel/sched/idle.c:94 [inline]
 cpuidle_idle_call /kernel/sched/idle.c:154 [inline]
 do_idle+0x1d7/0x790 /kernel/sched/idle.c:263
 cpu_startup_entry+0x45/0x50 /kernel/sched/idle.c:354
 start_secondary+0x3c0/0x4d0 /arch/x86/kernel/smpboot.c:265
 secondary_startup_64+0xa4/0xb0 /arch/x86/kernel/head_64.S:243

Uninit was stored to memory at:
 kmsan_save_stack_with_flags /mm/kmsan/kmsan.c:187 [inline]
 kmsan_internal_chain_origin+0xcc/0x150 /mm/kmsan/kmsan.c:345
 __msan_chain_origin+0x6b/0xe0 /mm/kmsan/kmsan_instr.c:190
 __write_once_size /./include/linux/compiler.h:230 [inline]
 commit_creds+0xcc8/0x1430 /kernel/cred.c:474
 install_exec_creds+0x7d/0x1a0 /fs/exec.c:1455
 load_elf_binary+0x132b/0x5f60 /fs/binfmt_elf.c:881
 search_binary_handler+0x2f4/0xad0 /fs/exec.c:1658
 exec_binprm /fs/exec.c:1701 [inline]
 __do_execve_file+0x2218/0x2ed0 /fs/exec.c:1821
 do_execveat_common /fs/exec.c:1868 [inline]
 do_execve /fs/exec.c:1885 [inline]
 __do_sys_execve /fs/exec.c:1961 [inline]
 __se_sys_execve+0xec/0x110 /fs/exec.c:1956
 __x64_sys_execve+0x4a/0x70 /fs/exec.c:1956
 do_syscall_64+0xbc/0xf0 /arch/x86/entry/common.c:302
 entry_SYSCALL_64_after_hwframe+0x63/0xe7

Uninit was created at:
 kmsan_save_stack_with_flags /mm/kmsan/kmsan.c:187 [inline]
 kmsan_internal_poison_shadow+0x53/0xa0 /mm/kmsan/kmsan.c:146
 kmsan_slab_free+0x8d/0x100 /mm/kmsan/kmsan_hooks.c:195
 slab_free_freelist_hook /mm/slub.c:1449 [inline]
 slab_free /mm/slub.c:3019 [inline]
 kfree+0x4b2/0x2960 /mm/slub.c:3975
 rsi_91x_deinit+0x40e/0x460 /drivers/net/wireless/rsi/rsi_91x_main.c:407
 rsi_probe+0x1ebf/0x24d0 /drivers/net/wireless/rsi/rsi_91x_usb.c:834
 usb_probe_interface+0xd19/0x1310 /drivers/usb/core/driver.c:361
 really_probe+0x1344/0x1d90 /drivers/base/dd.c:513
 driver_probe_device+0x1ba/0x510 /drivers/base/dd.c:670
 __device_attach_driver+0x5b8/0x790 /drivers/base/dd.c:777
 bus_for_each_drv+0x28e/0x3b0 /drivers/base/bus.c:454
 __device_attach+0x489/0x750 /drivers/base/dd.c:843
 device_initial_probe+0x4a/0x60 /drivers/base/dd.c:890
 bus_probe_device+0x131/0x390 /drivers/base/bus.c:514
 device_add+0x25b5/0x2df0 /drivers/base/core.c:2111
 usb_set_configuration+0x309f/0x3710 /drivers/usb/core/message.c:2027
 generic_probe+0xe7/0x280 /drivers/usb/core/generic.c:210
 usb_probe_device+0x146/0x200 /drivers/usb/core/driver.c:266
 really_probe+0x1344/0x1d90 /drivers/base/dd.c:513
 driver_probe_device+0x1ba/0x510 /drivers/base/dd.c:670
 __device_attach_driver+0x5b8/0x790 /drivers/base/dd.c:777
 bus_for_each_drv+0x28e/0x3b0 /drivers/base/bus.c:454
 __device_attach+0x489/0x750 /drivers/base/dd.c:843
 device_initial_probe+0x4a/0x60 /drivers/base/dd.c:890
 bus_probe_device+0x131/0x390 /drivers/base/bus.c:514
 device_add+0x25b5/0x2df0 /drivers/base/core.c:2111
 usb_new_device+0x23e5/0x2fb0 /drivers/usb/core/hub.c:2534
 hub_port_connect /drivers/usb/core/hub.c:5089 [inline]
 hub_port_connect_change /drivers/usb/core/hub.c:5204 [inline]
 port_event /drivers/usb/core/hub.c:5350 [inline]
 hub_event+0x5853/0x7320 /drivers/usb/core/hub.c:5432
 process_one_work+0x1572/0x1f00 /kernel/workqueue.c:2269
 worker_thread+0x111b/0x2460 /kernel/workqueue.c:2415
 kthread+0x4b5/0x4f0 /kernel/kthread.c:256
 ret_from_fork+0x35/0x40 /arch/x86/entry/entry_64.S:355
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/07/21 23:21 https://github.com/google/kmsan.git master beaab8a31e0d 1656845f .config console log report syz C ci-upstream-kmsan-gce
* Struck through repros no longer work on HEAD.