syzbot


KMSAN: uninit-value in loaded_vmcs_init

Status: closed as invalid on 2018/10/08 08:59
Subsystems: kvm-x86
[Documentation on labels]
First crash: 2521d, last: 2516d

Sample crash report:
IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details.
8021q: adding VLAN 0 to HW filter on device team0
==================================================================
BUG: KMSAN: uninit-value in vmcs_clear arch/x86/kvm/vmx.c:2119 [inline]
BUG: KMSAN: uninit-value in loaded_vmcs_init+0x343/0x590 arch/x86/kvm/vmx.c:2126
CPU: 1 PID: 7734 Comm: syz-executor5 Not tainted 4.19.0-rc4+ #63
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x306/0x460 lib/dump_stack.c:113
 kmsan_report+0x1a3/0x2d0 mm/kmsan/kmsan.c:917
 __msan_warning+0x7c/0xe0 mm/kmsan/kmsan_instr.c:500
 vmcs_clear arch/x86/kvm/vmx.c:2119 [inline]
 loaded_vmcs_init+0x343/0x590 arch/x86/kvm/vmx.c:2126
 __loaded_vmcs_clear+0x2fb/0x3c0 arch/x86/kvm/vmx.c:2209
 flush_smp_call_function_queue+0x404/0x770 kernel/smp.c:243
 generic_smp_call_function_single_interrupt+0x1f/0x30 kernel/smp.c:192
 smp_call_function_single_interrupt+0x2f7/0x530 arch/x86/kernel/smp.c:296
 call_function_single_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:891
 </IRQ>
RIP: 0010:native_restore_fl arch/x86/include/asm/irqflags.h:40 [inline]
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/irqflags.h:81 [inline]
RIP: 0010:kmsan_internal_check_memory+0x1aa/0x210 mm/kmsan/kmsan.c:983
Code: 45 89 f8 ff 75 b8 6a 01 e8 a3 fb ff ff 48 83 c4 10 48 8b 45 a8 ff 88 7c 09 00 00 75 55 e8 3e e3 36 ff 4c 89 65 90 ff 75 90 9d <eb> 15 ff 8b 7c 09 00 00 75 4e e8 27 e3 36 ff 4c 89 65 98 ff 75 98
RSP: 0000:ffff88014156f850 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff04
RAX: ffff880148fabc00 RBX: 0000000000000008 RCX: 000000010230f918
RDX: 0000000000000500 RSI: ffff88021fff2000 RDI: 0000000000000500
RBP: ffff88014156f8c0 R08: ffffffff7fffffff R09: 0000000000000002
R10: 0000000096fcd000 R11: ffffffffffffffff R12: 0000000000000246
R13: 0000000000000008 R14: 0000000000000000 R15: ffffffffffffffff
 kmsan_check_memory+0xb/0x10 mm/kmsan/kmsan.c:988
 atomic_read include/asm-generic/atomic-instrumented.h:33 [inline]
 static_key_count include/linux/jump_label.h:194 [inline]
 mem_cgroup_disabled include/linux/memcontrol.h:333 [inline]
 lock_page_memcg+0x97/0x470 mm/memcontrol.c:1862
 page_add_file_rmap+0xef/0x9b0 mm/rmap.c:1184
 alloc_set_pte+0x92c/0x2530 mm/memory.c:3468
 filemap_map_pages+0x13f4/0x1d80 mm/filemap.c:2678
 do_fault_around mm/memory.c:3615 [inline]
 do_read_fault mm/memory.c:3649 [inline]
 do_fault mm/memory.c:3754 [inline]
 handle_pte_fault mm/memory.c:3985 [inline]
 __handle_mm_fault mm/memory.c:4109 [inline]
 handle_mm_fault+0x3e7d/0xa3b0 mm/memory.c:4146
 __do_page_fault+0xec9/0x1b50 arch/x86/mm/fault.c:1396
 do_page_fault+0x98/0xd0 arch/x86/mm/fault.c:1473
 page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1170
RIP: 0033:0x455e20
Code: 0f 05 48 3d 00 f0 ff ff 76 e0 f7 d8 64 41 89 01 eb d8 0f 1f 84 00 00 00 00 00 f7 d8 64 41 89 01 eb d7 0f 1f 84 00 00 00 00 00 <b8> 3b 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 3d cb fb ff c3 66 2e
RSP: 002b:0000000000a3fac8 EFLAGS: 00010207
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000041f650
RDX: 00007ffe7daa09e8 RSI: 0000000000a3fb00 RDI: 00000000004dac7b
RBP: 0000000000a3fc80 R08: 0000000000000000 R09: 0000000000000032
R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000a3fef0
R13: 0000000000a3fe28 R14: 0000000000000000 R15: 0000000000000000

Local variable description: ----error.i@loaded_vmcs_init
Variable was created at:
 loaded_vmcs_init+0x8a/0x590 arch/x86/kvm/vmx.c:2125
 __loaded_vmcs_clear+0x2fb/0x3c0 arch/x86/kvm/vmx.c:2209
==================================================================

Crashes (33):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/10/08 08:40 https://github.com/google/kmsan.git master b2efdb2ef006 8b311eaf .config console log report ci-upstream-kmsan-gce
2018/10/08 02:05 https://github.com/google/kmsan.git master b2efdb2ef006 8b311eaf .config console log report ci-upstream-kmsan-gce
2018/10/08 01:29 https://github.com/google/kmsan.git master b2efdb2ef006 8b311eaf .config console log report ci-upstream-kmsan-gce
2018/10/07 11:56 https://github.com/google/kmsan.git master b2efdb2ef006 8b311eaf .config console log report ci-upstream-kmsan-gce
2018/10/07 09:10 https://github.com/google/kmsan.git master b2efdb2ef006 8b311eaf .config console log report ci-upstream-kmsan-gce
2018/10/07 07:06 https://github.com/google/kmsan.git master b2efdb2ef006 8b311eaf .config console log report ci-upstream-kmsan-gce
2018/10/07 00:08 https://github.com/google/kmsan.git master b2efdb2ef006 8b311eaf .config console log report ci-upstream-kmsan-gce
2018/10/06 21:58 https://github.com/google/kmsan.git master b2efdb2ef006 8b311eaf .config console log report ci-upstream-kmsan-gce
2018/10/06 19:53 https://github.com/google/kmsan.git master b2efdb2ef006 8b311eaf .config console log report ci-upstream-kmsan-gce
2018/10/06 15:31 https://github.com/google/kmsan.git master b2efdb2ef006 8b311eaf .config console log report ci-upstream-kmsan-gce
2018/10/06 14:11 https://github.com/google/kmsan.git master b2efdb2ef006 8b311eaf .config console log report ci-upstream-kmsan-gce
2018/10/06 06:06 https://github.com/google/kmsan.git master b2efdb2ef006 8b311eaf .config console log report ci-upstream-kmsan-gce
2018/10/06 05:53 https://github.com/google/kmsan.git master b2efdb2ef006 8b311eaf .config console log report ci-upstream-kmsan-gce
2018/10/06 01:05 https://github.com/google/kmsan.git master b2efdb2ef006 8b311eaf .config console log report ci-upstream-kmsan-gce
2018/10/05 23:34 https://github.com/google/kmsan.git master b2efdb2ef006 8b311eaf .config console log report ci-upstream-kmsan-gce
2018/10/05 23:11 https://github.com/google/kmsan.git master b2efdb2ef006 8b311eaf .config console log report ci-upstream-kmsan-gce
2018/10/05 17:22 https://github.com/google/kmsan.git master b2efdb2ef006 8b311eaf .config console log report ci-upstream-kmsan-gce
2018/10/05 15:57 https://github.com/google/kmsan.git master b2efdb2ef006 8b311eaf .config console log report ci-upstream-kmsan-gce
2018/10/05 14:38 https://github.com/google/kmsan.git master b2efdb2ef006 8b311eaf .config console log report ci-upstream-kmsan-gce
2018/10/05 11:56 https://github.com/google/kmsan.git master b2efdb2ef006 8b311eaf .config console log report ci-upstream-kmsan-gce
2018/10/05 09:46 https://github.com/google/kmsan.git master b2efdb2ef006 8b311eaf .config console log report ci-upstream-kmsan-gce
2018/10/04 20:07 https://github.com/google/kmsan.git master b2efdb2ef006 8b311eaf .config console log report ci-upstream-kmsan-gce
2018/10/04 14:05 https://github.com/google/kmsan.git master b2efdb2ef006 8b311eaf .config console log report ci-upstream-kmsan-gce
2018/10/04 12:45 https://github.com/google/kmsan.git master b2efdb2ef006 8b311eaf .config console log report ci-upstream-kmsan-gce
2018/10/04 10:46 https://github.com/google/kmsan.git master b2efdb2ef006 8b311eaf .config console log report ci-upstream-kmsan-gce
2018/10/04 09:26 https://github.com/google/kmsan.git master b2efdb2ef006 8b311eaf .config console log report ci-upstream-kmsan-gce
2018/10/04 06:00 https://github.com/google/kmsan.git master b2efdb2ef006 8b311eaf .config console log report ci-upstream-kmsan-gce
2018/10/04 05:16 https://github.com/google/kmsan.git master b2efdb2ef006 8b311eaf .config console log report ci-upstream-kmsan-gce
2018/10/03 20:24 https://github.com/google/kmsan.git master b2efdb2ef006 8b311eaf .config console log report ci-upstream-kmsan-gce
2018/10/03 17:15 https://github.com/google/kmsan.git master b2efdb2ef006 8b311eaf .config console log report ci-upstream-kmsan-gce
2018/10/03 13:30 https://github.com/google/kmsan.git master b2efdb2ef006 0f3e0261 .config console log report ci-upstream-kmsan-gce
2018/10/03 12:13 https://github.com/google/kmsan.git master b2efdb2ef006 0f3e0261 .config console log report ci-upstream-kmsan-gce
2018/10/03 07:08 https://github.com/google/kmsan.git master b2efdb2ef006 0f3e0261 .config console log report ci-upstream-kmsan-gce
* Struck through repros no longer work on HEAD.