Re: [syzbot] [io-uring?] KMSAN: uninit-value in io_req_cqe_overflow (3)

[syzbot <syzbot+e6616d0dc8ded5dc56d6@syzkaller.appspotmail.com>]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

: Dummy 1
[   50.085324][    T1]   #1: Loopback 1
[   50.089179][    T1]   #2: Virtual MIDI Card 1
[   50.099411][   T10] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2
[   50.110715][    T1] md: Waiting for all devices to be available before autodetect
[   50.110769][    T1] md: If you don't use raid, use raid=noautodetect
[   50.110836][    T1] md: Autodetecting RAID arrays.
[   50.110883][    T1] md: autorun ...
[   50.119809][   T10] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db
[   50.125316][    T1] md: ... autorun DONE.
[   50.234241][    T1] EXT4-fs (sda1): mounted filesystem 5941fea2-f5fa-4b4e-b5ef-9af118b27b95 ro with ordered data mode. Quota mode: none.
[   50.247976][    T1] VFS: Mounted root (ext4 filesystem) readonly on device 8:1.
[   50.325610][    T1] devtmpfs: mounted
[   50.579226][    T1] Freeing unused kernel image (initmem) memory: 37032K
[   50.590992][    T1] Write protecting the kernel read-only data: 262144k
[   50.636998][    T1] Freeing unused kernel image (rodata/data gap) memory: 1808K
[   52.297749][    T1] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[   52.307966][    T1] x86/mm: Checking user space page tables
[   53.810797][    T1] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[   53.819734][    T1] Failed to set sysctl parameter 'kernel.hung_task_all_cpu_backtrace=1': parameter not found
[   53.841397][    T1] Failed to set sysctl parameter 'max_rcu_stall_to_panic=1': parameter not found
[   53.853295][    T1] Run /sbin/init as init process
[   55.624426][ T4453] mount (4453) used greatest stack depth: 8144 bytes left
[   55.700932][ T4454] EXT4-fs (sda1): re-mounted 5941fea2-f5fa-4b4e-b5ef-9af118b27b95 r/w. Quota mode: none.
mount: mounting smackfs on /sys/fs/smackfs failed: No such file or directory
mount: mounting selinuxfs on /sys/fs/selinux failed: No such file or directory
[   56.048626][ T4457] mount (4457) used greatest stack depth: 5568 bytes left
Starting syslogd: OK
Starting acpid: OK
Starting klogd: OK
Running sysctl: OK
Populating /dev using udev: [   59.882175][ T4487] udevd[4487]: starting version 3.2.11
[   63.461760][ T4488] udevd[4488]: starting eudev-3.2.11
[   63.474018][ T4487] udevd (4487) used greatest stack depth: 5288 bytes left
[   96.328335][ T1216] net_ratelimit: 2 callbacks suppressed
[   96.328413][ T1216] aoe: packet could not be sent on lo.  consider increasing tx_queue_len
[   96.343724][ T1216] aoe: packet could not be sent on bond0.  consider increasing tx_queue_len
[   96.352822][ T1216] aoe: packet could not be sent on dummy0.  consider increasing tx_queue_len
[   96.362365][ T1216] aoe: packet could not be sent on eql.  consider increasing tx_queue_len
[   96.371420][ T1216] aoe: packet could not be sent on ifb0.  consider increasing tx_queue_len
[   96.380617][ T1216] aoe: packet could not be sent on ifb1.  consider increasing tx_queue_len
[   96.390232][ T1216] aoe: packet could not be sent on eth0.  consider increasing tx_queue_len
[   96.399307][ T1216] aoe: packet could not be sent on wlan0.  consider increasing tx_queue_len
[   96.408742][ T1216] aoe: packet could not be sent on wlan1.  consider increasing tx_queue_len
[   96.417980][ T1216] aoe: packet could not be sent on hwsim0.  consider increasing tx_queue_len
done
Starting system message bus: done
Starting iptables: OK
Starting network: OK
Starting dhcpcd...
dhcpcd-9.4.1 starting
dev: loaded udev
DUID 00:04:98:24:4c:28:99:7c:d9:70:fe:51:ca:fe:56:33:2c:7d
forked to background, child pid 4700
[  111.646112][ T4701] 8021q: adding VLAN 0 to HW filter on device bond0
[  111.665731][ T4701] eql: remember to turn off Van-Jacobson compression on your slave devices
[  111.739327][   T10] cfg80211: failed to load regulatory.db
Starting sshd: [  114.013627][    C0] =====================================================
[  114.021043][    C0] BUG: KMSAN: uninit-value in receive_buf+0x25e3/0x5fd0
[  114.028525][    C0]  receive_buf+0x25e3/0x5fd0
[  114.033381][    C0]  virtnet_poll+0xd1c/0x23c0
[  114.038271][    C0]  __napi_poll+0xe7/0x980
[  114.042818][    C0]  net_rx_action+0x82a/0x1850
[  114.047892][    C0]  handle_softirqs+0x1ce/0x800
[  114.052877][    C0]  __irq_exit_rcu+0x68/0x120
[  114.057788][    C0]  irq_exit_rcu+0x12/0x20
[  114.062305][    C0]  common_interrupt+0x94/0xa0
[  114.067214][    C0]  asm_common_interrupt+0x2b/0x40
[  114.072524][    C0]  unmap_page_range+0x437/0x8670
[  114.077770][    C0]  unmap_single_vma+0x380/0x490
[  114.082992][    C0]  unmap_vmas+0x34a/0x610
[  114.087600][    C0]  exit_mmap+0x236/0xe60
[  114.091998][    C0]  __mmput+0x147/0x5d0
[  114.096258][    C0]  mmput+0x8a/0xa0
[  114.100278][    C0]  exec_mmap+0x80a/0x9b0
[  114.104689][    C0]  begin_new_exec+0x1ac4/0x2bd0
[  114.109838][    C0]  load_elf_binary+0x1412/0x4e10
[  114.114974][    C0]  bprm_execve+0xc57/0x21c0
[  114.119763][    C0]  do_execveat_common+0xceb/0xd70
[  114.124999][    C0]  __x64_sys_execve+0xf4/0x130
[  114.130048][    C0]  x64_sys_call+0x164f/0x3b90
[  114.135028][    C0]  do_syscall_64+0xcd/0x1e0
[  114.139822][    C0]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  114.145930][    C0] 
[  114.148491][    C0] Uninit was created at:
[  114.152960][    C0]  __alloc_pages_noprof+0x9d6/0xe70
[  114.158456][    C0]  alloc_pages_mpol_noprof+0x299/0x990
[  114.164147][    C0]  alloc_pages_noprof+0x1bf/0x1e0
[  114.169493][    C0]  skb_page_frag_refill+0x2bf/0x7c0
[  114.175099][    C0]  virtnet_rq_alloc+0x43/0xbb0
[  114.180136][    C0]  try_fill_recv+0x3f0/0x2f50
[  114.184984][    C0]  virtnet_open+0x1cc/0xb00
[  114.189780][    C0]  __dev_open+0x546/0x6f0
[  114.194331][    C0]  __dev_change_flags+0x309/0x9a0
[  114.199804][    C0]  dev_change_flags+0x8e/0x1d0
[  114.204763][    C0]  devinet_ioctl+0x13ec/0x22c0
[  114.209866][    C0]  inet_ioctl+0x4bd/0x6d0
[  114.214386][    C0]  sock_do_ioctl+0xb7/0x540
[  114.219190][    C0]  sock_ioctl+0x727/0xd70
[  114.223697][    C0]  __se_sys_ioctl+0x261/0x450
[  114.228714][    C0]  __x64_sys_ioctl+0x96/0xe0
[  114.233472][    C0]  x64_sys_call+0x18c0/0x3b90
[  114.238517][    C0]  do_syscall_64+0xcd/0x1e0
[  114.243222][    C0]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  114.249490][    C0] 
[  114.251937][    C0] CPU: 0 PID: 4799 Comm: S50sshd Not tainted 6.10.0-rc1-syzkaller-00009-gf4a1254f2a07 #0
[  114.262178][    C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
[  114.272668][    C0] =====================================================
[  114.279876][    C0] Disabling lock debugging due to kernel taint
[  114.286162][    C0] Kernel panic - not syncing: kmsan.panic set ...
[  114.292711][    C0] CPU: 0 PID: 4799 Comm: S50sshd Tainted: G    B              6.10.0-rc1-syzkaller-00009-gf4a1254f2a07 #0
[  114.304458][    C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
[  114.314789][    C0] Call Trace:
[  114.318203][    C0]  <IRQ>
[  114.321156][    C0]  dump_stack_lvl+0x216/0x2d0
[  114.326043][    C0]  ? kmsan_get_shadow_origin_ptr+0x4d/0xb0
[  114.332094][    C0]  dump_stack+0x1e/0x30
[  114.336442][    C0]  panic+0x4e2/0xcd0
[  114.340533][    C0]  ? kmsan_get_metadata+0x111/0x1d0
[  114.345974][    C0]  kmsan_report+0x2d5/0x2e0
[  114.350698][    C0]  ? kmsan_alloc_page+0x182/0x220
[  114.355934][    C0]  ? kmsan_get_metadata+0x146/0x1d0
[  114.361337][    C0]  ? __msan_warning+0x95/0x120
[  114.366312][    C0]  ? receive_buf+0x25e3/0x5fd0
[  114.371293][    C0]  ? virtnet_poll+0xd1c/0x23c0
[  114.376247][    C0]  ? __napi_poll+0xe7/0x980
[  114.380957][    C0]  ? net_rx_action+0x82a/0x1850
[  114.386121][    C0]  ? handle_softirqs+0x1ce/0x800
[  114.391359][    C0]  ? __irq_exit_rcu+0x68/0x120
[  114.396339][    C0]  ? irq_exit_rcu+0x12/0x20
[  114.401043][    C0]  ? common_interrupt+0x94/0xa0
[  114.406205][    C0]  ? asm_common_interrupt+0x2b/0x40
[  114.411631][    C0]  ? unmap_page_range+0x437/0x8670
[  114.417009][    C0]  ? unmap_single_vma+0x380/0x490
[  114.422335][    C0]  ? unmap_vmas+0x34a/0x610
[  114.427043][    C0]  ? exit_mmap+0x236/0xe60
[  114.431644][    C0]  ? __mmput+0x147/0x5d0
[  114.436101][    C0]  ? mmput+0x8a/0xa0
[  114.440190][    C0]  ? exec_mmap+0x80a/0x9b0
[  114.444795][    C0]  ? begin_new_exec+0x1ac4/0x2bd0
[  114.450011][    C0]  ? load_elf_binary+0x1412/0x4e10
[  114.455320][    C0]  ? bprm_execve+0xc57/0x21c0
[  114.460196][    C0]  ? do_execveat_common+0xceb/0xd70
[  114.465599][    C0]  ? __x64_sys_execve+0xf4/0x130
[  114.470719][    C0]  ? x64_sys_call+0x164f/0x3b90
[  114.475779][    C0]  ? do_syscall_64+0xcd/0x1e0
[  114.480647][    C0]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  114.486933][    C0]  ? kmsan_internal_memmove_metadata+0x17b/0x230
[  114.493494][    C0]  ? kmsan_get_metadata+0x146/0x1d0
[  114.498917][    C0]  ? kmsan_get_metadata+0x146/0x1d0
[  114.504332][    C0]  ? page_to_skb+0xdae/0x1620
[  114.509232][    C0]  __msan_warning+0x95/0x120
[  114.514026][    C0]  receive_buf+0x25e3/0x5fd0
[  114.518819][    C0]  ? kmsan_get_metadata+0x146/0x1d0
[  114.524319][    C0]  ? kmsan_get_shadow_origin_ptr+0x4d/0xb0
[  114.530382][    C0]  virtnet_poll+0xd1c/0x23c0
[  114.535205][    C0]  ? __pfx_virtnet_poll+0x10/0x10
[  114.540952][    C0]  __napi_poll+0xe7/0x980
[  114.545495][    C0]  ? kmsan_get_metadata+0x146/0x1d0
[  114.550961][    C0]  net_rx_action+0x82a/0x1850
[  114.555904][    C0]  ? sched_clock_cpu+0x55/0x870
[  114.560969][    C0]  ? __pfx_net_rx_action+0x10/0x10
[  114.566314][    C0]  handle_softirqs+0x1ce/0x800
[  114.571324][    C0]  __irq_exit_rcu+0x68/0x120
[  114.576116][    C0]  irq_exit_rcu+0x12/0x20
[  114.580642][    C0]  common_interrupt+0x94/0xa0
[  114.585603][    C0]  </IRQ>
[  114.588665][    C0]  <TASK>
[  114.591713][    C0]  asm_common_interrupt+0x2b/0x40
[  114.596959][    C0] RIP: 0010:unmap_page_range+0x437/0x8670
[  114.602895][    C0] Code: 01 00 00 48 83 bc 24 38 02 00 00 00 0f 85 a2 79 00 00 48 8b bc 24 f8 01 00 00 48 8b 1f 48 89 5c 24 20 e8 4c 22 26 00 4c 8b 30 <44> 8b 22 48 83 e3 9f 49 c7 45 00 00 00 00 00 4c 89 f0 48 83 e0 9f
[  114.622720][    C0] RSP: 0018:ffff8881178032f0 EFLAGS: 00000286
[  114.628967][    C0] RAX: ffff88811a3767f8 RBX: 800000011786d067 RCX: 000000011a7767f8
[  114.637129][    C0] RDX: ffff88811a7767f8 RSI: ffff88813fff9230 RDI: ffff88811ab767f8
[  114.645292][    C0] RBP: ffff888117803578 R08: ffffea000000000f R09: 0000000000000000
[  114.653453][    C0] R10: ffff888117003698 R11: 0000000000000004 R12: 0000000000000000
[  114.661696][    C0] R13: ffff888117a1ac00 R14: 0000000000000000 R15: 00007fef966eafff
[  114.669872][    C0]  ? kmsan_get_metadata+0x146/0x1d0
[  114.675323][    C0]  ? kmsan_get_metadata+0x146/0x1d0
[  114.680765][    C0]  ? kmsan_get_metadata+0x146/0x1d0
[  114.686196][    C0]  ? kmsan_get_shadow_origin_ptr+0x4d/0xb0
[  114.692245][    C0]  ? kmsan_get_metadata+0x146/0x1d0
[  114.697670][    C0]  ? kmsan_get_shadow_origin_ptr+0x4d/0xb0
[  114.703716][    C0]  ? kmsan_get_metadata+0x146/0x1d0
[  114.709137][    C0]  ? kmsan_get_shadow_origin_ptr+0x4d/0xb0
[  114.715203][    C0]  unmap_single_vma+0x380/0x490
[  114.720293][    C0]  unmap_vmas+0x34a/0x610
[  114.724956][    C0]  exit_mmap+0x236/0xe60
[  114.729417][    C0]  ? kmsan_get_shadow_origin_ptr+0x4d/0xb0
[  114.735450][    C0]  __mmput+0x147/0x5d0
[  114.739725][    C0]  ? kmsan_internal_unpoison_memory+0x14/0x20
[  114.746005][    C0]  mmput+0x8a/0xa0
[  114.749934][    C0]  exec_mmap+0x80a/0x9b0
[  114.754382][    C0]  begin_new_exec+0x1ac4/0x2bd0
[  114.759451][    C0]  load_elf_binary+0x1412/0x4e10
[  114.764594][    C0]  ? kmsan_get_metadata+0x146/0x1d0
[  114.770014][    C0]  ? kmsan_internal_set_shadow_origin+0x66/0xe0
[  114.776491][    C0]  ? kmsan_internal_unpoison_memory+0x14/0x20
[  114.782774][    C0]  ? load_elf_binary+0x1341/0x4e10
[  114.788101][    C0]  ? kmsan_get_metadata+0x146/0x1d0
[  114.793557][    C0]  ? __pfx_load_elf_binary+0x10/0x10
[  114.799058][    C0]  bprm_execve+0xc57/0x21c0
[  114.803804][    C0]  do_execveat_common+0xceb/0xd70
[  114.809069][    C0]  __x64_sys_execve+0xf4/0x130
[  114.814046][    C0]  x64_sys_call+0x164f/0x3b90
[  114.818961][    C0]  do_syscall_64+0xcd/0x1e0
[  114.823690][    C0]  ? clear_bhb_loop+0x25/0x80
[  114.828613][    C0]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  114.834753][    C0] RIP: 0033:0x7fef96824ef7
[  114.839364][    C0] Code: Unable to access opcode bytes at 0x7fef96824ecd.
[  114.846558][    C0] RSP: 002b:00007ffee5058098 EFLAGS: 00000246 ORIG_RAX: 000000000000003b
[  114.855184][    C0] RAX: ffffffffffffffda RBX: 0000556bd3625190 RCX: 00007fef96824ef7
[  114.863430][    C0] RDX: 0000556bd36251a8 RSI: 0000556bd3625190 RDI: 0000556bd3625210
[  114.871579][    C0] RBP: 0000556bd3625210 R08: 0000556bd3625215 R09: 00007ffee5059fa2
[  114.879814][    C0] R10: 0000000000000008 R11: 0000000000000246 R12: 0000556bd36251a8
[  114.887957][    C0] R13: 00007fef969d2904 R14: 0000556bd36251a8 R15: 0000000000000000
[  114.896125][    C0]  </TASK>
[  114.899544][    C0] Kernel Offset: disabled
[  114.903930][    C0] Rebooting in 86400 seconds..


syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.21.4'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build827277809=/tmp/go-build -gno-record-gcc-switches'

git status (err=<nil>)
HEAD detached at 2aa5052fed
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
go fmt ./sys/... >/dev/null
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=2aa5052fed5f8993afacfce02174322df0f03ec4 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240612-135002'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=2aa5052fed5f8993afacfce02174322df0f03ec4 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240612-135002'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
	-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"2aa5052fed5f8993afacfce02174322df0f03ec4\"


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=12f14736980000


Tested on:

commit:         f4a1254f io_uring: fix cancellation overwriting req->f..
git tree:       git://git.kernel.dk/linux.git io_uring-6.10
kernel config:  https://syzkaller.appspot.com/x/.config?x=54d66e52f38a45d8
dashboard link: https://syzkaller.appspot.com/bug?extid=e6616d0dc8ded5dc56d6
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

Note: no patches were applied.