syzbot


KMSAN: uninit-value in cfb_imageblit

Status: auto-closed as invalid on 2021/01/31 10:02
Subsystems: fbdev
[Documentation on labels]
Reported-by: syzbot+50bc4646cbe1b0a9a08b@syzkaller.appspotmail.com
First crash: 1305d, last: 1262d
Discussions (1)
Title Replies (including bot) Last reply
KMSAN: uninit-value in cfb_imageblit 0 (1) 2020/08/21 16:57

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in fast_imageblit drivers/video/fbdev/core/cfbimgblt.c:256 [inline]
BUG: KMSAN: uninit-value in cfb_imageblit+0x1c71/0x2a60 drivers/video/fbdev/core/cfbimgblt.c:300
CPU: 0 PID: 8700 Comm: syz-executor.2 Not tainted 5.9.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x21c/0x280 lib/dump_stack.c:118
 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:122
 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:201
 fast_imageblit drivers/video/fbdev/core/cfbimgblt.c:256 [inline]
 cfb_imageblit+0x1c71/0x2a60 drivers/video/fbdev/core/cfbimgblt.c:300
 vga16fb_imageblit+0xda2/0x20c0 drivers/video/fbdev/vga16fb.c:1250
 bit_putcs+0x3039/0x3390 drivers/video/fbdev/core/bitblit.c:105
 fbcon_putcs+0x121c/0x1250 drivers/video/fbdev/core/fbcon.c:1362
 con_flush drivers/tty/vt/vt.c:2575 [inline]
 do_con_write+0x4336/0x12340 drivers/tty/vt/vt.c:2905
 con_write+0x9c/0x190 drivers/tty/vt/vt.c:3250
 process_output_block drivers/tty/n_tty.c:595 [inline]
 n_tty_write+0x167a/0x2230 drivers/tty/n_tty.c:2333
 do_tty_write drivers/tty/tty_io.c:962 [inline]
 tty_write+0x9fb/0x1610 drivers/tty/tty_io.c:1046
 do_loop_readv_writev fs/read_write.c:737 [inline]
 do_iter_write+0x909/0x1090 fs/read_write.c:1020
 compat_writev+0x333/0x650 fs/read_write.c:1371
 do_compat_writev fs/read_write.c:1392 [inline]
 __do_compat_sys_writev fs/read_write.c:1403 [inline]
 __se_compat_sys_writev+0x18f/0x3f0 fs/read_write.c:1399
 __ia32_compat_sys_writev+0x4a/0x70 fs/read_write.c:1399
 do_syscall_32_irqs_on arch/x86/entry/common.c:80 [inline]
 __do_fast_syscall_32+0x129/0x180 arch/x86/entry/common.c:139
 do_fast_syscall_32+0x6a/0xc0 arch/x86/entry/common.c:162
 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:205
 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c
RIP: 0023:0xf7f75549
Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 002b:00000000f556f0cc EFLAGS: 00000296 ORIG_RAX: 0000000000000092
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000020000000
RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000

Uninit was stored to memory at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:143 [inline]
 kmsan_internal_chain_origin+0xad/0x130 mm/kmsan/kmsan.c:311
 __msan_chain_origin+0x50/0x90 mm/kmsan/kmsan_instr.c:151
 __fb_pad_aligned_buffer include/linux/fb.h:654 [inline]
 bit_putcs_aligned drivers/video/fbdev/core/bitblit.c:96 [inline]
 bit_putcs+0x2dbd/0x3390 drivers/video/fbdev/core/bitblit.c:185
 fbcon_putcs+0x121c/0x1250 drivers/video/fbdev/core/fbcon.c:1362
 con_flush drivers/tty/vt/vt.c:2575 [inline]
 do_con_write+0x4336/0x12340 drivers/tty/vt/vt.c:2905
 con_write+0x9c/0x190 drivers/tty/vt/vt.c:3250
 process_output_block drivers/tty/n_tty.c:595 [inline]
 n_tty_write+0x167a/0x2230 drivers/tty/n_tty.c:2333
 do_tty_write drivers/tty/tty_io.c:962 [inline]
 tty_write+0x9fb/0x1610 drivers/tty/tty_io.c:1046
 do_loop_readv_writev fs/read_write.c:737 [inline]
 do_iter_write+0x909/0x1090 fs/read_write.c:1020
 compat_writev+0x333/0x650 fs/read_write.c:1371
 do_compat_writev fs/read_write.c:1392 [inline]
 __do_compat_sys_writev fs/read_write.c:1403 [inline]
 __se_compat_sys_writev+0x18f/0x3f0 fs/read_write.c:1399
 __ia32_compat_sys_writev+0x4a/0x70 fs/read_write.c:1399
 do_syscall_32_irqs_on arch/x86/entry/common.c:80 [inline]
 __do_fast_syscall_32+0x129/0x180 arch/x86/entry/common.c:139
 do_fast_syscall_32+0x6a/0xc0 arch/x86/entry/common.c:162
 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:205
 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:143 [inline]
 kmsan_internal_poison_shadow+0x66/0xd0 mm/kmsan/kmsan.c:126
 kmsan_slab_alloc+0x8a/0xe0 mm/kmsan/kmsan_hooks.c:80
 slab_alloc_node mm/slub.c:2907 [inline]
 slab_alloc mm/slub.c:2916 [inline]
 __kmalloc+0x2bb/0x4b0 mm/slub.c:3982
 kmalloc include/linux/slab.h:559 [inline]
 fbcon_set_font+0x5ad/0xfb0 drivers/video/fbdev/core/fbcon.c:2694
 con_font_set drivers/tty/vt/vt.c:4663 [inline]
 con_font_op+0x1e59/0x2290 drivers/tty/vt/vt.c:4728
 vt_io_ioctl drivers/tty/vt/vt_ioctl.c:586 [inline]
 vt_ioctl+0x14b2/0x6800 drivers/tty/vt/vt_ioctl.c:856
 vt_compat_ioctl+0x59b/0x1040 drivers/tty/vt/vt_ioctl.c:1257
 tty_compat_ioctl+0x74b/0x1660 drivers/tty/tty_io.c:2847
 __do_compat_sys_ioctl fs/ioctl.c:842 [inline]
 __se_compat_sys_ioctl+0x55f/0x1100 fs/ioctl.c:793
 __ia32_compat_sys_ioctl+0x4a/0x70 fs/ioctl.c:793
 do_syscall_32_irqs_on arch/x86/entry/common.c:80 [inline]
 __do_fast_syscall_32+0x129/0x180 arch/x86/entry/common.c:139
 do_fast_syscall_32+0x6a/0xc0 arch/x86/entry/common.c:162
 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:205
 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c
=====================================================

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/10/03 10:01 https://github.com/google/kmsan.git master 5edb1df295b9 2653fa43 .config console log report info ci-upstream-kmsan-gce-386
2020/09/26 21:40 https://github.com/google/kmsan.git master c5a13b33ec11 2d5ea0cb .config console log report info ci-upstream-kmsan-gce-386
2020/08/21 10:33 https://github.com/google/kmsan.git master ce8056d1f79e 6436ce4b .config console log report ci-upstream-kmsan-gce-386
* Struck through repros no longer work on HEAD.