syzbot


KMSAN: kernel-infoleak in ucma_init_qp_attr

Status: fixed on 2022/03/08 16:11
Subsystems: rdma
[Documentation on labels]
Reported-by: syzbot+6d532fa8f9463da290bc@syzkaller.appspotmail.com
Fix commit: b35a0f4dd544 RDMA/core: Don't infoleak GRH fields
First crash: 852d, last: 852d
Discussions (6)
Title Replies (including bot) Last reply
[PATCH 5.4 00/34] 5.4.171-rc1 review 41 (41) 2022/01/12 01:08
[PATCH 5.15 00/72] 5.15.14-rc1 review 82 (82) 2022/01/11 12:41
[PATCH 5.10 00/43] 5.10.91-rc1 review 53 (53) 2022/01/11 12:37
[PATCH 4.19 00/21] 4.19.225-rc1 review 29 (29) 2022/01/11 12:35
[PATCH 4.14 00/22] 4.14.262-rc1 review 25 (25) 2022/01/11 06:24
[syzbot] KMSAN: kernel-infoleak in ucma_init_qp_attr 1 (2) 2022/01/04 11:41

Sample crash report:
=====================================================
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:121 [inline]
BUG: KMSAN: kernel-infoleak in _copy_to_user+0x1c9/0x270 lib/usercopy.c:33
 instrument_copy_to_user include/linux/instrumented.h:121 [inline]
 _copy_to_user+0x1c9/0x270 lib/usercopy.c:33
 copy_to_user include/linux/uaccess.h:209 [inline]
 ucma_init_qp_attr+0x8c7/0xb10 drivers/infiniband/core/ucma.c:1242
 ucma_write+0x637/0x6c0 drivers/infiniband/core/ucma.c:1732
 vfs_write+0x8ce/0x2030 fs/read_write.c:588
 ksys_write+0x28b/0x510 fs/read_write.c:643
 __do_sys_write fs/read_write.c:655 [inline]
 __se_sys_write fs/read_write.c:652 [inline]
 __ia32_sys_write+0xdb/0x120 fs/read_write.c:652
 do_syscall_32_irqs_on arch/x86/entry/common.c:114 [inline]
 __do_fast_syscall_32+0x96/0xf0 arch/x86/entry/common.c:180
 do_fast_syscall_32+0x34/0x70 arch/x86/entry/common.c:205
 do_SYSENTER_32+0x1b/0x20 arch/x86/entry/common.c:248
 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c

Local variable resp created at:
 ucma_init_qp_attr+0xa4/0xb10 drivers/infiniband/core/ucma.c:1214
 ucma_write+0x637/0x6c0 drivers/infiniband/core/ucma.c:1732

Bytes 40-59 of 144 are uninitialized
Memory access of size 144 starts at ffff888167523b00
Data copied to user address 0000000020000100

CPU: 1 PID: 25910 Comm: syz-executor.1 Not tainted 5.16.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
=====================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/12/25 09:03 https://github.com/google/kmsan.git master 81c325bbf94e 6caa12e4 .config console log report info ci-upstream-kmsan-gce-386 KMSAN: kernel-infoleak in ucma_init_qp_attr
* Struck through repros no longer work on HEAD.