mmap: syz-executor6 (5807) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.txt. ================================================================== BUG: KMSAN: uninit-value in copyout lib/iov_iter.c:140 [inline] BUG: KMSAN: uninit-value in _copy_to_iter+0x46d/0x28f0 lib/iov_iter.c:571 CPU: 0 PID: 5814 Comm: syz-executor2 Not tainted 4.16.0+ #84 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x185/0x1d0 lib/dump_stack.c:53 kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067 kmsan_internal_check_memory+0x135/0x1e0 mm/kmsan/kmsan.c:1157 kmsan_copy_to_user+0x69/0x160 mm/kmsan/kmsan.c:1199 copyout lib/iov_iter.c:140 [inline] _copy_to_iter+0x46d/0x28f0 lib/iov_iter.c:571 copy_to_iter include/linux/uio.h:106 [inline] skb_copy_datagram_iter+0x443/0xf70 net/core/datagram.c:431 skb_copy_datagram_msg include/linux/skbuff.h:3264 [inline] packet_recvmsg+0x757/0x1cc0 net/packet/af_packet.c:3341 sock_recvmsg_nosec net/socket.c:803 [inline] sock_recvmsg+0x1d0/0x230 net/socket.c:810 ___sys_recvmsg+0x3fb/0x810 net/socket.c:2205 __sys_recvmsg net/socket.c:2250 [inline] SYSC_recvmsg+0x298/0x3c0 net/socket.c:2262 SyS_recvmsg+0x54/0x80 net/socket.c:2257 do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x3d/0xa2 RIP: 0033:0x455329 RSP: 002b:00007f39c3f2ec68 EFLAGS: 00000246 ORIG_RAX: 000000000000002f RAX: ffffffffffffffda RBX: 00007f39c3f2f6d4 RCX: 0000000000455329 RDX: 0000000000000000 RSI: 0000000020000700 RDI: 0000000000000015 RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 0000000000000496 R14: 00000000006f9eb0 R15: 0000000000000000 Uninit was stored to memory at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline] kmsan_save_stack mm/kmsan/kmsan.c:293 [inline] kmsan_internal_chain_origin+0x12b/0x210 mm/kmsan/kmsan.c:684 kmsan_memcpy_origins+0x11d/0x170 mm/kmsan/kmsan.c:526 __msan_memcpy+0x19f/0x1f0 mm/kmsan/kmsan_instr.c:470 pskb_expand_head+0x3a6/0x1a70 net/core/skbuff.c:1467 skb_unclone include/linux/skbuff.h:1437 [inline] skb_copy_ubufs+0x375/0x2640 net/core/skbuff.c:1181 skb_orphan_frags_rx include/linux/skbuff.h:2565 [inline] dev_queue_xmit_nit+0x1180/0x11e0 net/core/dev.c:1990 xmit_one net/core/dev.c:3022 [inline] dev_hard_start_xmit+0x27c/0xc70 net/core/dev.c:3042 __dev_queue_xmit+0x22d9/0x2b60 net/core/dev.c:3557 dev_queue_xmit+0x4b/0x60 net/core/dev.c:3590 neigh_hh_output include/net/neighbour.h:472 [inline] neigh_output include/net/neighbour.h:480 [inline] ip_finish_output2+0x1198/0x1380 net/ipv4/ip_output.c:229 ip_finish_output+0xcb0/0xff0 net/ipv4/ip_output.c:317 NF_HOOK_COND include/linux/netfilter.h:277 [inline] ip_output+0x502/0x5c0 net/ipv4/ip_output.c:405 dst_output include/net/dst.h:443 [inline] ip_local_out net/ipv4/ip_output.c:124 [inline] ip_queue_xmit+0x1fae/0x21c0 net/ipv4/ip_output.c:504 tcp_transmit_skb+0x38be/0x51f0 net/ipv4/tcp_output.c:1176 tcp_write_xmit+0x4311/0xb920 net/ipv4/tcp_output.c:2394 __tcp_push_pending_frames+0x124/0x3f0 net/ipv4/tcp_output.c:2567 tcp_push+0x8b6/0x9c0 net/ipv4/tcp.c:726 tcp_sendmsg_locked+0x5445/0x6d20 net/ipv4/tcp.c:1426 tcp_sendmsg+0xb2/0x100 net/ipv4/tcp.c:1463 inet_sendmsg+0x48d/0x740 net/ipv4/af_inet.c:764 sock_sendmsg_nosec net/socket.c:630 [inline] sock_sendmsg net/socket.c:640 [inline] sock_write_iter+0x3b9/0x470 net/socket.c:909 call_write_iter include/linux/fs.h:1782 [inline] new_sync_write fs/read_write.c:469 [inline] __vfs_write+0x719/0x910 fs/read_write.c:482 vfs_write+0x463/0x8d0 fs/read_write.c:544 SYSC_write+0x172/0x360 fs/read_write.c:589 SyS_write+0x55/0x80 fs/read_write.c:581 do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x3d/0xa2 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline] kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:188 kmsan_kmalloc+0x94/0x100 mm/kmsan/kmsan.c:314 kmsan_slab_alloc+0x11/0x20 mm/kmsan/kmsan.c:321 slab_post_alloc_hook mm/slab.h:445 [inline] slab_alloc_node mm/slub.c:2737 [inline] __kmalloc_node_track_caller+0xaed/0x11c0 mm/slub.c:4369 __kmalloc_reserve net/core/skbuff.c:138 [inline] __alloc_skb+0x2cf/0x9f0 net/core/skbuff.c:206 alloc_skb_fclone include/linux/skbuff.h:1026 [inline] sk_stream_alloc_skb+0x17c/0xcf0 net/ipv4/tcp.c:866 tcp_sendmsg_locked+0x2cc0/0x6d20 net/ipv4/tcp.c:1301 tcp_sendmsg+0xb2/0x100 net/ipv4/tcp.c:1463 inet_sendmsg+0x48d/0x740 net/ipv4/af_inet.c:764 sock_sendmsg_nosec net/socket.c:630 [inline] sock_sendmsg net/socket.c:640 [inline] SYSC_sendto+0x6c3/0x7e0 net/socket.c:1747 SyS_sendto+0x8a/0xb0 net/socket.c:1715 do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x3d/0xa2 Bytes 18-19 of 66 are uninitialized ==================================================================