syzbot


KMSAN: uninit-value in mpol_rebind_mm (2)
Status: upstream: reported C repro on 2022/02/11 09:07
Reported-by: syzbot+ad1b8c404f0959c4bfcc@syzkaller.appspotmail.com
Fix commit: 018160ad314d mm/mempolicy: fix uninit-value in mpol_rebind_policy()
Patched on: [ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-upstream-gce-leak ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-linux-next-kasan-gce-root ci2-upstream-kcsan-gce], missing on: [ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-kmsan-gce ci-upstream-kmsan-gce-386 ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-usb]
First crash: 109d, last: 5d15h
similar bugs (1):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in mpol_rebind_mm 6 1158d 1243d 12/22 fixed on 2019/03/28 12:00
Patch testing requests:
Created Duration User Patch Repo Result
2022/05/15 03:44 20m wanngchenng@gmail.com patch https://github.com/google/kmsan.git master OK

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in mpol_rebind_policy mm/mempolicy.c:352 [inline]
BUG: KMSAN: uninit-value in mpol_rebind_mm+0x35b/0x460 mm/mempolicy.c:383
 mpol_rebind_policy mm/mempolicy.c:352 [inline]
 mpol_rebind_mm+0x35b/0x460 mm/mempolicy.c:383
 cpuset_attach+0xe28/0x15e0 kernel/cgroup/cpuset.c:2291
 cgroup_migrate_execute+0x1023/0x1d20 kernel/cgroup/cgroup.c:2515
 cgroup_migrate kernel/cgroup/cgroup.c:2771 [inline]
 cgroup_attach_task+0x540/0x8b0 kernel/cgroup/cgroup.c:2804
 __cgroup1_procs_write+0x5cc/0x7a0 kernel/cgroup/cgroup-v1.c:520
 cgroup1_procs_write+0x97/0xb0 kernel/cgroup/cgroup-v1.c:533
 cgroup_file_write+0x4c2/0x9e0 kernel/cgroup/cgroup.c:3852
 kernfs_fop_write_iter+0x66a/0x9f0 fs/kernfs/file.c:296
 call_write_iter include/linux/fs.h:2162 [inline]
 new_sync_write fs/read_write.c:503 [inline]
 vfs_write+0x1318/0x2030 fs/read_write.c:590
 ksys_write+0x28b/0x510 fs/read_write.c:643
 __do_sys_write fs/read_write.c:655 [inline]
 __se_sys_write fs/read_write.c:652 [inline]
 __x64_sys_write+0xdb/0x120 fs/read_write.c:652
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Uninit was stored to memory at:
 __mpol_dup+0x107/0x480 mm/mempolicy.c:2326
 mpol_dup include/linux/mempolicy.h:87 [inline]
 vma_replace_policy mm/mempolicy.c:762 [inline]
 mbind_range+0x13ee/0x1e40 mm/mempolicy.c:833
 do_mbind+0x13d2/0x1b30 mm/mempolicy.c:1323
 kernel_mbind mm/mempolicy.c:1477 [inline]
 __do_sys_mbind mm/mempolicy.c:1484 [inline]
 __se_sys_mbind+0x51c/0xc80 mm/mempolicy.c:1480
 __x64_sys_mbind+0x19d/0x200 mm/mempolicy.c:1480
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Uninit was created at:
 slab_post_alloc_hook mm/slab.h:524 [inline]
 slab_alloc_node mm/slub.c:3251 [inline]
 slab_alloc mm/slub.c:3259 [inline]
 kmem_cache_alloc+0x902/0x11c0 mm/slub.c:3264
 mpol_new mm/mempolicy.c:293 [inline]
 do_mbind+0x8f5/0x1b30 mm/mempolicy.c:1279
 kernel_mbind mm/mempolicy.c:1477 [inline]
 __do_sys_mbind mm/mempolicy.c:1484 [inline]
 __se_sys_mbind+0x51c/0xc80 mm/mempolicy.c:1480
 __x64_sys_mbind+0x19d/0x200 mm/mempolicy.c:1480
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x44/0xae

CPU: 0 PID: 3474 Comm: syz-executor399 Not tainted 5.16.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
=====================================================

Crashes (10):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kmsan-gce 2022/02/07 09:54 https://github.com/google/kmsan.git master 85cfd6e539bd a7dab638 .config log report syz C KMSAN: uninit-value in mpol_rebind_mm
ci-upstream-kmsan-gce 2022/05/22 02:52 https://github.com/google/kmsan.git master c5c93da9af13 7268fa62 .config log report info KMSAN: uninit-value in mpol_rebind_mm
ci-upstream-kmsan-gce 2022/05/13 21:06 https://github.com/google/kmsan.git master d6e2c8c7eb40 107f6434 .config log report info KMSAN: uninit-value in mpol_rebind_mm
ci-upstream-kmsan-gce 2022/04/25 01:33 https://github.com/google/kmsan.git master b834db009dc5 131df97d .config log report info KMSAN: uninit-value in mpol_rebind_mm
ci-upstream-kmsan-gce 2022/04/11 10:46 https://github.com/google/kmsan.git master 33d9269ef6e0 e22c3da3 .config log report info KMSAN: uninit-value in mpol_rebind_mm
ci-upstream-kmsan-gce 2022/03/23 22:31 https://github.com/google/kmsan.git master 97c7732c2bb6 5ff41e94 .config log report info KMSAN: uninit-value in mpol_rebind_mm
ci-upstream-kmsan-gce 2022/03/19 11:39 https://github.com/google/kmsan.git master 97c7732c2bb6 e2d91b1d .config log report info KMSAN: uninit-value in mpol_rebind_mm
ci-upstream-kmsan-gce 2022/03/06 23:01 https://github.com/google/kmsan.git master 724946410067 7bdd8b2c .config log report info KMSAN: uninit-value in mpol_rebind_mm
ci-upstream-kmsan-gce 2022/02/07 08:40 https://github.com/google/kmsan.git master 85cfd6e539bd a7dab638 .config log report info KMSAN: uninit-value in mpol_rebind_mm
ci-upstream-kmsan-gce-386 2022/05/13 21:07 https://github.com/google/kmsan.git master d6e2c8c7eb40 107f6434 .config log report info KMSAN: uninit-value in mpol_rebind_mm