syzbot


KMSAN: uninit-value in io_req_cqe_overflow

Status: upstream: reported C repro on 2022/09/06 13:22
Subsystems: io-uring (incorrect?)
Reported-by: syzbot+12dde80bf174ac8ae285@syzkaller.appspotmail.com
First crash: 214d, last: 14h50m
similar bugs (2):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in preempt_count_add C 6657 172d 172d 0/24 closed as invalid on 2022/10/10 13:29
upstream general protection fault in io_issue_sqe io-uring C done unreliable 502 216d 573d 0/24 upstream: reported C repro on 2021/09/02 17:34

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in io_req_cqe_overflow+0x1f8/0x220 io_uring/io_uring.c:687
 io_req_cqe_overflow+0x1f8/0x220 io_uring/io_uring.c:687
 __io_fill_cqe_req+0x4ad/0x830 io_uring/io_uring.h:121
 __io_submit_flush_completions io_uring/io_uring.c:1192 [inline]
 io_submit_flush_completions+0x11c/0x390 io_uring/io_uring.c:166
 io_submit_state_end io_uring/io_uring.c:2025 [inline]
 io_submit_sqes+0x7d3/0xd50 io_uring/io_uring.c:2137
 __do_sys_io_uring_enter io_uring/io_uring.c:3053 [inline]
 __se_sys_io_uring_enter+0x597/0x1d30 io_uring/io_uring.c:2983
 __x64_sys_io_uring_enter+0x117/0x190 io_uring/io_uring.c:2983
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Uninit was stored to memory at:
 io_req_set_res io_uring/io_uring.h:156 [inline]
 io_recv_finish io_uring/net.c:537 [inline]
 io_recv+0x18ee/0x1d00 io_uring/net.c:845
 io_issue_sqe+0x3b1/0x11d0 io_uring/io_uring.c:1576
 io_queue_sqe io_uring/io_uring.c:1753 [inline]
 io_submit_sqe+0xb40/0x1be0 io_uring/io_uring.c:2011
 io_submit_sqes+0x542/0xd50 io_uring/io_uring.c:2122
 __do_sys_io_uring_enter io_uring/io_uring.c:3053 [inline]
 __se_sys_io_uring_enter+0x597/0x1d30 io_uring/io_uring.c:2983
 __x64_sys_io_uring_enter+0x117/0x190 io_uring/io_uring.c:2983
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Local variable msg created at:
 io_recv+0x4b/0x1d00 io_uring/net.c:763
 io_issue_sqe+0x3b1/0x11d0 io_uring/io_uring.c:1576

CPU: 0 PID: 3487 Comm: syz-executor126 Not tainted 6.0.0-rc2-syzkaller-47461-gac3859c02d7f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
=====================================================

Crashes (450):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-upstream-kmsan-gce 2022/08/28 15:47 https://github.com/google/kmsan.git master ac3859c02d7f 07177916 .config strace log report syz C KMSAN: uninit-value in io_req_cqe_overflow
ci-upstream-kmsan-gce 2023/03/17 11:30 https://github.com/google/kmsan.git master 34add094f9de 18b58603 .config strace log report syz C [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_rw_fail
ci-upstream-kmsan-gce 2022/12/07 07:08 https://github.com/google/kmsan.git master 30d2727189c5 d88f3abb .config strace log report syz C [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_rw_fail
ci-upstream-kmsan-gce 2023/01/08 23:31 https://github.com/google/kmsan.git master 5c6259d6d19f 1dac8c7a .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_req_cqe_overflow
ci-upstream-kmsan-gce 2022/08/28 14:49 https://github.com/google/kmsan.git master ac3859c02d7f 07177916 .config console log report info KMSAN: uninit-value in io_req_cqe_overflow
ci2-upstream-fs 2023/02/18 13:25 upstream 38f8ccde04a3 d02e9a70 .config console log report info [disk image] [vmlinux] [kernel image] general protection fault in __io_uring_show_fdinfo
ci-upstream-kasan-gce-smack-root 2022/10/17 00:00 upstream 55be6084c8e0 67cb024c .config console log report info [disk image] [vmlinux] KASAN: use-after-free Read in __io_uring_show_fdinfo
ci-upstream-kmsan-gce 2023/03/30 01:19 https://github.com/google/kmsan.git master 90ea0df61c98 f325deb0 .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_submit_flush_completions
ci-upstream-kmsan-gce 2023/03/29 02:54 https://github.com/google/kmsan.git master 90ea0df61c98 fc067f05 .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_submit_flush_completions
ci-upstream-kmsan-gce 2023/03/28 20:55 https://github.com/google/kmsan.git master 90ea0df61c98 48c74771 .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in __io_req_complete_post
ci-upstream-kmsan-gce 2023/03/28 14:10 https://github.com/google/kmsan.git master 90ea0df61c98 48c74771 .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_submit_flush_completions
ci-upstream-kmsan-gce 2023/03/26 14:01 https://github.com/google/kmsan.git master 90ea0df61c98 fbf0499a .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_submit_flush_completions
ci-upstream-kmsan-gce 2023/03/26 07:44 https://github.com/google/kmsan.git master 90ea0df61c98 fbf0499a .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_rw_fail
ci-upstream-kmsan-gce 2023/03/26 06:02 https://github.com/google/kmsan.git master 90ea0df61c98 fbf0499a .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in __io_req_complete_post
ci-upstream-kmsan-gce 2023/03/26 05:06 https://github.com/google/kmsan.git master 90ea0df61c98 fbf0499a .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_submit_flush_completions
ci-upstream-kmsan-gce 2023/03/25 20:53 https://github.com/google/kmsan.git master 90ea0df61c98 fbf0499a .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_submit_flush_completions
ci-upstream-kmsan-gce 2023/03/25 15:29 https://github.com/google/kmsan.git master 90ea0df61c98 fbf0499a .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_rw_fail
ci-upstream-kmsan-gce 2023/03/24 18:28 https://github.com/google/kmsan.git master 90ea0df61c98 9700afae .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_rw_fail
ci-upstream-kmsan-gce 2023/03/24 10:48 https://github.com/google/kmsan.git master 90ea0df61c98 f94b4a29 .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_submit_flush_completions
ci-upstream-kmsan-gce 2023/03/24 06:31 https://github.com/google/kmsan.git master 90ea0df61c98 f94b4a29 .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_submit_flush_completions
ci-upstream-kmsan-gce 2023/03/24 01:49 https://github.com/google/kmsan.git master 90ea0df61c98 f94b4a29 .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_submit_flush_completions
ci-upstream-kmsan-gce 2023/03/23 13:03 https://github.com/google/kmsan.git master 90ea0df61c98 f94b4a29 .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_rw_fail
ci-upstream-kmsan-gce 2023/03/22 20:33 https://github.com/google/kmsan.git master 90ea0df61c98 d846e076 .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_submit_flush_completions
ci-upstream-kmsan-gce 2023/03/22 14:40 https://github.com/google/kmsan.git master 90ea0df61c98 d846e076 .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_submit_flush_completions
ci-upstream-kmsan-gce 2023/03/21 16:44 https://github.com/google/kmsan.git master 90ea0df61c98 03fb9538 .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in __io_req_complete_post
ci-upstream-kmsan-gce 2023/03/21 05:52 https://github.com/google/kmsan.git master 90ea0df61c98 7939252e .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_rw_fail
ci-upstream-kmsan-gce 2023/03/21 01:36 https://github.com/google/kmsan.git master 90ea0df61c98 7939252e .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in __io_req_complete_post
ci-upstream-kmsan-gce 2023/03/20 22:12 https://github.com/google/kmsan.git master 90ea0df61c98 7939252e .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_rw_fail
ci-upstream-kmsan-gce 2023/03/20 14:40 https://github.com/google/kmsan.git master 90ea0df61c98 7939252e .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_submit_flush_completions
ci-upstream-kmsan-gce 2023/03/20 07:38 https://github.com/google/kmsan.git master 34add094f9de 7939252e .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_submit_flush_completions
ci-upstream-kmsan-gce 2023/03/20 01:05 https://github.com/google/kmsan.git master 34add094f9de 7939252e .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in __io_req_complete_post
ci-upstream-kmsan-gce 2023/03/19 22:03 https://github.com/google/kmsan.git master 34add094f9de 7939252e .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_submit_flush_completions
ci-upstream-kmsan-gce 2023/03/19 18:18 https://github.com/google/kmsan.git master 34add094f9de 7939252e .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_submit_flush_completions
ci-upstream-kmsan-gce 2023/03/19 13:20 https://github.com/google/kmsan.git master 34add094f9de 7939252e .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_submit_flush_completions
ci-upstream-kmsan-gce 2023/03/19 00:01 https://github.com/google/kmsan.git master 34add094f9de 7939252e .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_submit_flush_completions
ci-upstream-kmsan-gce 2023/03/18 09:12 https://github.com/google/kmsan.git master 34add094f9de 7939252e .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_submit_flush_completions
ci-upstream-kmsan-gce 2023/03/17 18:42 https://github.com/google/kmsan.git master 34add094f9de 18b58603 .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_submit_flush_completions
ci-upstream-kmsan-gce 2023/03/17 10:29 https://github.com/google/kmsan.git master 34add094f9de 18b58603 .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_rw_fail
ci-upstream-kmsan-gce 2023/03/17 03:35 https://github.com/google/kmsan.git master 34add094f9de 18b58603 .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in __io_req_complete_post
ci-upstream-kmsan-gce 2023/03/16 22:40 https://github.com/google/kmsan.git master 34add094f9de 18b58603 .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_submit_flush_completions
ci-upstream-kmsan-gce 2023/03/16 15:33 https://github.com/google/kmsan.git master 34add094f9de 18b58603 .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_rw_fail
ci-upstream-kmsan-gce 2023/03/16 12:40 https://github.com/google/kmsan.git master 34add094f9de 18b58603 .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_rw_fail
ci-upstream-kmsan-gce 2023/03/16 10:48 https://github.com/google/kmsan.git master 34add094f9de 18b58603 .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_submit_flush_completions
ci-upstream-kmsan-gce 2023/03/16 01:07 https://github.com/google/kmsan.git master 34add094f9de 18b58603 .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_rw_fail
ci-upstream-kmsan-gce 2023/03/15 23:46 https://github.com/google/kmsan.git master 34add094f9de 18b58603 .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_submit_flush_completions
ci-upstream-kmsan-gce 2023/03/15 18:19 https://github.com/google/kmsan.git master 34add094f9de 18b58603 .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_submit_flush_completions
ci-upstream-kmsan-gce 2023/03/14 17:01 https://github.com/google/kmsan.git master 34add094f9de 0d5c4377 .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_rw_fail
ci-upstream-kmsan-gce 2023/03/13 21:55 https://github.com/google/kmsan.git master 34add094f9de 026e2200 .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_rw_fail
ci-upstream-kmsan-gce 2023/03/13 06:54 https://github.com/google/kmsan.git master e61893130d87 5205ef30 .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in __io_req_complete_post
ci-upstream-kmsan-gce 2023/03/13 01:58 https://github.com/google/kmsan.git master e61893130d87 5205ef30 .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_submit_flush_completions
ci-upstream-kmsan-gce 2023/03/12 23:49 https://github.com/google/kmsan.git master e61893130d87 5205ef30 .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_submit_flush_completions
ci-upstream-kmsan-gce 2023/03/12 21:44 https://github.com/google/kmsan.git master e61893130d87 5205ef30 .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_submit_flush_completions
ci-upstream-kmsan-gce 2022/10/14 20:42 https://github.com/google/kmsan.git master 968c2729e576 4954e4b2 .config console log report info [disk image] [vmlinux] KMSAN: uninit-value in __io_uring_show_fdinfo
ci-upstream-kmsan-gce-386 2023/03/28 18:36 https://github.com/google/kmsan.git master 90ea0df61c98 48c74771 .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_submit_flush_completions
ci-upstream-kmsan-gce-386 2023/03/23 06:29 https://github.com/google/kmsan.git master 90ea0df61c98 f94b4a29 .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_rw_fail
ci-upstream-kmsan-gce-386 2023/03/22 17:44 https://github.com/google/kmsan.git master 90ea0df61c98 d846e076 .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_rw_fail
ci-upstream-kmsan-gce-386 2023/03/21 23:05 https://github.com/google/kmsan.git master 90ea0df61c98 8b4eb097 .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_submit_flush_completions
ci-upstream-kmsan-gce-386 2023/03/21 14:04 https://github.com/google/kmsan.git master 90ea0df61c98 03fb9538 .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_submit_flush_completions
ci-upstream-kmsan-gce-386 2023/03/20 11:47 https://github.com/google/kmsan.git master 90ea0df61c98 7939252e .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_submit_flush_completions
ci-upstream-kmsan-gce-386 2023/03/18 17:38 https://github.com/google/kmsan.git master 34add094f9de 7939252e .config console log report info [disk image] [vmlinux] [kernel image] KMSAN: uninit-value in io_rw_fail
* Struck through repros no longer work on HEAD.