From: syzbot <syzbot+bbafcc77279b6c156e52@syzkaller.appspotmail.com>
To: davem@davemloft.net, edumazet@google.com, kuba@kernel.org,
linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
pabeni@redhat.com, syzkaller-bugs@googlegroups.com
Subject: [syzbot] [net?] KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern
Date: Mon, 06 May 2024 01:26:23 -0700 [thread overview]
Message-ID: <000000000000235bec0617c4d391@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: 7367539ad4b0 Merge tag 'cxl-fixes-6.9-rc7' of git://git.ke..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1444078b180000
kernel config: https://syzkaller.appspot.com/x/.config?x=bbf567496022057b
dashboard link: https://syzkaller.appspot.com/bug?extid=bbafcc77279b6c156e52
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: i386
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/b037b3fdb412/disk-7367539a.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/715a45b086cb/vmlinux-7367539a.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a13ab40a70b3/bzImage-7367539a.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+bbafcc77279b6c156e52@syzkaller.appspotmail.com
=====================================================
BUG: KMSAN: uninit-value in cmsghdr_from_user_compat_to_kern+0x568/0x10d0 net/compat.c:154
cmsghdr_from_user_compat_to_kern+0x568/0x10d0 net/compat.c:154
____sys_sendmsg+0x222/0xb60 net/socket.c:2546
__sys_sendmsg_sock+0x42/0x60 net/socket.c:2650
io_sendmsg+0x47a/0x1020 io_uring/net.c:453
io_issue_sqe+0x371/0x1150 io_uring/io_uring.c:1897
io_wq_submit_work+0xa17/0xeb0 io_uring/io_uring.c:2006
io_worker_handle_work+0xc3a/0x2050 io_uring/io-wq.c:596
io_wq_worker+0x5a1/0x1370 io_uring/io-wq.c:649
ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Uninit was stored to memory at:
io_sendmsg+0x6a4/0x1020 io_uring/net.c:435
io_issue_sqe+0x371/0x1150 io_uring/io_uring.c:1897
io_wq_submit_work+0xa17/0xeb0 io_uring/io_uring.c:2006
io_worker_handle_work+0xc3a/0x2050 io_uring/io-wq.c:596
io_wq_worker+0x5a1/0x1370 io_uring/io-wq.c:649
ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Uninit was created at:
__alloc_pages+0x9d6/0xe70 mm/page_alloc.c:4598
__alloc_pages_node include/linux/gfp.h:238 [inline]
alloc_pages_node include/linux/gfp.h:261 [inline]
alloc_slab_page mm/slub.c:2175 [inline]
allocate_slab mm/slub.c:2338 [inline]
new_slab+0x2de/0x1400 mm/slub.c:2391
___slab_alloc+0x1184/0x33d0 mm/slub.c:3525
__kmem_cache_alloc_bulk mm/slub.c:4555 [inline]
kmem_cache_alloc_bulk+0x503/0x13e0 mm/slub.c:4629
__io_alloc_req_refill+0x248/0x780 io_uring/io_uring.c:1101
io_alloc_req io_uring/io_uring.h:405 [inline]
io_submit_sqes+0xaba/0x2fe0 io_uring/io_uring.c:2481
__do_sys_io_uring_enter io_uring/io_uring.c:3668 [inline]
__se_sys_io_uring_enter+0x407/0x4400 io_uring/io_uring.c:3603
__ia32_sys_io_uring_enter+0x11d/0x1a0 io_uring/io_uring.c:3603
ia32_sys_call+0x2c0/0x40a0 arch/x86/include/generated/asm/syscalls_32.h:427
do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
__do_fast_syscall_32+0xb4/0x120 arch/x86/entry/common.c:386
do_fast_syscall_32+0x38/0x80 arch/x86/entry/common.c:411
do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:449
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
CPU: 1 PID: 20102 Comm: iou-wrk-20100 Tainted: G W 6.9.0-rc6-syzkaller-00234-g7367539ad4b0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
=====================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
reply other threads:[~2024-05-06 8:26 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000235bec0617c4d391@google.com \
--to=syzbot+bbafcc77279b6c156e52@syzkaller.appspotmail.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.