syzbot


KMSAN: uninit-value in __hrtimer_run_queues

Status: closed as invalid on 2018/06/27 15:38
Subsystems: kernel
[Documentation on labels]
First crash: 2664d, last: 2651d

Sample crash report:
==================================================================
BUG: KMSAN: uninit-value in hrtimer_get_softexpires_tv64 include/linux/hrtimer.h:275 [inline]
BUG: KMSAN: uninit-value in __hrtimer_run_queues+0x39a/0x15d0 kernel/time/hrtimer.c:1457
CPU: 1 PID: 4520 Comm: syz-executor2 Not tainted 4.17.0-rc5+ #103
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x185/0x1d0 lib/dump_stack.c:113
 kmsan_report+0x149/0x260 mm/kmsan/kmsan.c:1084
 __msan_warning_32+0x6e/0xc0 mm/kmsan/kmsan_instr.c:686
 hrtimer_get_softexpires_tv64 include/linux/hrtimer.h:275 [inline]
 __hrtimer_run_queues+0x39a/0x15d0 kernel/time/hrtimer.c:1457
 hrtimer_interrupt+0x451/0x13c0 kernel/time/hrtimer.c:1518
 local_apic_timer_interrupt+0x66/0x230 arch/x86/kernel/apic/apic.c:1025
 smp_apic_timer_interrupt+0x5a/0x90 arch/x86/kernel/apic/apic.c:1053
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:863
 </IRQ>
RIP: 0010:native_restore_fl arch/x86/include/asm/irqflags.h:37 [inline]
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/irqflags.h:78 [inline]
RIP: 0010:__msan_poison_alloca+0x14c/0x1d0 mm/kmsan/kmsan_instr.c:652
RSP: 0018:ffff88016822fb70 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 00000000c2c0007f RBX: 00000000c2c0007f RCX: ffff88016822fbb0
RDX: 0000000000000004 RSI: 0000000000000004 RDI: 00000000ef855642
RBP: ffff88016822fc10 R08: 0000000001080020 R09: 0000000000000002
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
R13: ffffffff8ac8a530 R14: 0000000000000246 R15: ffff88019addd7c0
 hrtimer_start_range_ns+0xa6/0x17e0 kernel/time/hrtimer.c:1103
 hrtimer_start_expires include/linux/hrtimer.h:412 [inline]
 do_nanosleep+0x24b/0x9b0 kernel/time/hrtimer.c:1686
 hrtimer_nanosleep kernel/time/hrtimer.c:1743 [inline]
 __do_sys_nanosleep kernel/time/hrtimer.c:1775 [inline]
 __se_sys_nanosleep+0x4b3/0x6a0 kernel/time/hrtimer.c:1762
 __x64_sys_nanosleep+0x92/0xc0 kernel/time/hrtimer.c:1762
 do_syscall_64+0x152/0x230 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x481110
RSP: 002b:0000000000a3ea98 EFLAGS: 00000246 ORIG_RAX: 0000000000000023
RAX: ffffffffffffffda RBX: 000000000000004d RCX: 0000000000481110
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000a3eaa0
RBP: 000000000001f3b1 R08: 0000000000000001 R09: 0000000000c26940
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000001 R14: 00000000000001b4 R15: 000000000001f3a1

Uninit was stored to memory at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:279 [inline]
 kmsan_save_stack mm/kmsan/kmsan.c:294 [inline]
 kmsan_internal_chain_origin+0x12b/0x210 mm/kmsan/kmsan.c:685
 __msan_chain_origin+0x69/0xc0 mm/kmsan/kmsan_instr.c:529
 timerqueue_del+0x24d/0x270 lib/timerqueue.c:85
 __remove_hrtimer kernel/time/hrtimer.c:984 [inline]
 __run_hrtimer kernel/time/hrtimer.c:1380 [inline]
 __hrtimer_run_queues+0x89a/0x15d0 kernel/time/hrtimer.c:1460
 hrtimer_interrupt+0x451/0x13c0 kernel/time/hrtimer.c:1518
 local_apic_timer_interrupt+0x66/0x230 arch/x86/kernel/apic/apic.c:1025
 smp_apic_timer_interrupt+0x5a/0x90 arch/x86/kernel/apic/apic.c:1053
Uninit was stored to memory at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:279 [inline]
 kmsan_save_stack mm/kmsan/kmsan.c:294 [inline]
 kmsan_internal_chain_origin+0x12b/0x210 mm/kmsan/kmsan.c:685
 __msan_chain_origin+0x69/0xc0 mm/kmsan/kmsan_instr.c:529
 rb_link_node include/linux/rbtree.h:111 [inline]
 timerqueue_add+0x3fe/0x4f0 lib/timerqueue.c:57
 enqueue_hrtimer kernel/time/hrtimer.c:960 [inline]
 __run_hrtimer kernel/time/hrtimer.c:1413 [inline]
 __hrtimer_run_queues+0x1228/0x15d0 kernel/time/hrtimer.c:1460
 hrtimer_interrupt+0x451/0x13c0 kernel/time/hrtimer.c:1518
 local_apic_timer_interrupt+0x66/0x230 arch/x86/kernel/apic/apic.c:1025
 smp_apic_timer_interrupt+0x5a/0x90 arch/x86/kernel/apic/apic.c:1053
Local variable description: ----flags.i.i.i.i@_raw_spin_lock_irqsave
Variable was created at:
 _raw_spin_lock_irqsave+0x45/0xf0 kernel/locking/spinlock.c:150
 update_wall_time+0x79/0x1ed0 kernel/time/timekeeping.c:2037
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/05/30 10:34 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/05/17 11:59 https://github.com/google/kmsan.git master 8a1c25bfc1f0 90c54c49 .config console log report ci-upstream-kmsan-gce
* Struck through repros no longer work on HEAD.