syzbot


https://github.com/google/kmsan.git boot error: KMSAN: kernel-infoleak in copy_page_to_iter

Status: closed as invalid on 2018/07/20 11:08
Subsystems: net
[Documentation on labels]
First crash: 2633d, last: 2633d

Sample crash report:
mount (2203) used greatest stack depth: 56680 bytes left
touch (2207) used greatest stack depth: 56040 bytes left
EXT4-fs (sda1): re-mounted. Opts: (null)
logsave (3804) used greatest stack depth: 55440 bytes left
random: dd: uninitialized urandom read (512 bytes read)
BUG: KMSAN: kernel-infoleak in copyout lib/iov_iter.c:140 [inline]
BUG: KMSAN: kernel-infoleak in copy_page_to_iter_iovec lib/iov_iter.c:212 [inline]
BUG: KMSAN: kernel-infoleak in copy_page_to_iter+0x754/0x1b70 lib/iov_iter.c:716
CPU: 1 PID: 4206 Comm: dhclient Not tainted 4.17.0+ #3
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x185/0x1d0 lib/dump_stack.c:113
 kmsan_report+0x188/0x2a0 mm/kmsan/kmsan.c:1117
 kmsan_internal_check_memory+0x17e/0x1f0 mm/kmsan/kmsan.c:1230
 kmsan_copy_to_user+0x7a/0x160 mm/kmsan/kmsan.c:1253
 copyout lib/iov_iter.c:140 [inline]
 copy_page_to_iter_iovec lib/iov_iter.c:212 [inline]
 copy_page_to_iter+0x754/0x1b70 lib/iov_iter.c:716
 skb_copy_datagram_iter+0x7f2/0xfa0 net/core/datagram.c:450
 skb_copy_datagram_msg include/linux/skbuff.h:3268 [inline]
 packet_recvmsg+0x75a/0x1d10 net/packet/af_packet.c:3352
 sock_recvmsg_nosec net/socket.c:802 [inline]
 sock_recvmsg net/socket.c:809 [inline]
 sock_read_iter+0x40a/0x480 net/socket.c:886
 call_read_iter include/linux/fs.h:1778 [inline]
 new_sync_read fs/read_write.c:406 [inline]
 __vfs_read+0x775/0x9d0 fs/read_write.c:418
 vfs_read+0x36c/0x6b0 fs/read_write.c:452
 ksys_read fs/read_write.c:578 [inline]
 __do_sys_read fs/read_write.c:588 [inline]
 __se_sys_read fs/read_write.c:586 [inline]
 __x64_sys_read+0x1bf/0x3e0 fs/read_write.c:586
 do_syscall_64+0x15b/0x230 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7ff51f003310
RSP: 002b:00007ffd0f6ddff8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 000055e4769f6a50 RCX: 00007ff51f003310
RDX: 0000000000000600 RSI: 00007ffd0f6de010 RDI: 0000000000000004
RBP: 0000000000000001 R08: 00007ffd0f6de6a0 R09: 000000000000c8fe
R10: 003a0c56d5385d0c R11: 0000000000000246 R12: 00007ffd0f6de6a0
R13: 00007ffd0f6de670 R14: 00007ffd0f6de6c0 R15: 00007ff51f453010

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:279 [inline]
 kmsan_alloc_meta_for_pages+0x161/0x3a0 mm/kmsan/kmsan.c:815
 kmsan_alloc_page+0x82/0xe0 mm/kmsan/kmsan.c:885
 __alloc_pages_nodemask+0xf7b/0x5cc0 mm/page_alloc.c:4402
 alloc_pages_current+0x6b1/0x970 mm/mempolicy.c:2093
 alloc_pages include/linux/gfp.h:494 [inline]
 skb_page_frag_refill+0x3ba/0x5e0 net/core/sock.c:2211
 add_recvbuf_mergeable drivers/net/virtio_net.c:1067 [inline]
 try_fill_recv+0x3d5/0x2580 drivers/net/virtio_net.c:1108
 virtnet_open+0x188/0x600 drivers/net/virtio_net.c:1311
 __dev_open+0x613/0x840 net/core/dev.c:1392
 __dev_change_flags+0x401/0xb60 net/core/dev.c:6955
 dev_change_flags+0xca/0x230 net/core/dev.c:7024
 do_setlink+0x165b/0x6010 net/core/rtnetlink.c:2362
 rtnl_newlink+0x2b33/0x37a0 net/core/rtnetlink.c:2970
 rtnetlink_rcv_msg+0xa44/0x1570 net/core/rtnetlink.c:4646
 netlink_rcv_skb+0x37e/0x600 net/netlink/af_netlink.c:2448
 rtnetlink_rcv+0x50/0x60 net/core/rtnetlink.c:4664
 netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
 netlink_unicast+0x1680/0x1750 net/netlink/af_netlink.c:1336
 netlink_sendmsg+0x104f/0x1350 net/netlink/af_netlink.c:1901
 sock_sendmsg_nosec net/socket.c:629 [inline]
 sock_sendmsg net/socket.c:639 [inline]
 ___sys_sendmsg+0xec8/0x1320 net/socket.c:2117
 __sys_sendmsg net/socket.c:2155 [inline]
 __do_sys_sendmsg net/socket.c:2164 [inline]
 __se_sys_sendmsg net/socket.c:2162 [inline]
 __x64_sys_sendmsg+0x331/0x460 net/socket.c:2162
 do_syscall_64+0x15b/0x230 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Bytes 316-327 of 328 are uninitialized
Memory access starts at ffff88019568808c
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/06/12 17:27 https://github.com/google/kmsan.git master 98f29226d97d 598eb192 .config console log report ci-upstream-kmsan-gce
2018/06/12 09:57 https://github.com/google/kmsan.git master 98f29226d97d 112eec79 .config console log report ci-upstream-kmsan-gce
* Struck through repros no longer work on HEAD.