From: syzbot <syzbot+603bcd9b0bf1d94dbb9b@syzkaller.appspotmail.com>
To: andrii@kernel.org, ast@kernel.org, bpf@vger.kernel.org,
daniel@iogearbox.net, eddyz87@gmail.com, haoluo@google.com,
john.fastabend@gmail.com, jolsa@kernel.org,
kernel-team@meta.com, kpsingh@kernel.org,
linux-kernel@vger.kernel.org, martin.lau@linux.dev,
patchwork-bot@kernel.org, sdf@google.com, song@kernel.org,
syzkaller-bugs@googlegroups.com, yonghong.song@linux.dev
Subject: Re: [syzbot] [bpf?] KMSAN: uninit-value in trie_delete_elem
Date: Fri, 29 Mar 2024 12:52:20 -0700 [thread overview]
Message-ID: <000000000000486e1f0614d1fa5f@google.com> (raw)
In-Reply-To: <000000000000f9ce6d061494e694@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: 317c7bc0ef03 Merge tag 'mmc-v6.9-rc1' of git://git.kernel...
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=121ddb95180000
kernel config: https://syzkaller.appspot.com/x/.config?x=e2599baf258ef795
dashboard link: https://syzkaller.appspot.com/bug?extid=603bcd9b0bf1d94dbb9b
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15af8b0d180000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1590903d180000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/eea0b23c3f68/disk-317c7bc0.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/440f7aea55b5/vmlinux-317c7bc0.xz
kernel image: https://storage.googleapis.com/syzbot-assets/ecb91ede16f9/bzImage-317c7bc0.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+603bcd9b0bf1d94dbb9b@syzkaller.appspotmail.com
=====================================================
BUG: KMSAN: uninit-value in trie_delete_elem+0xc0/0xbe0 kernel/bpf/lpm_trie.c:448
trie_delete_elem+0xc0/0xbe0 kernel/bpf/lpm_trie.c:448
____bpf_map_delete_elem kernel/bpf/helpers.c:77 [inline]
bpf_map_delete_elem+0x5c/0x80 kernel/bpf/helpers.c:73
___bpf_prog_run+0x13fe/0xe0f0 kernel/bpf/core.c:1997
__bpf_prog_run96+0xb5/0xe0 kernel/bpf/core.c:2236
bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline]
__bpf_prog_run include/linux/filter.h:657 [inline]
bpf_prog_run include/linux/filter.h:664 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline]
bpf_trace_run2+0x116/0x300 kernel/trace/bpf_trace.c:2420
__bpf_trace_kfree+0x29/0x40 include/trace/events/kmem.h:94
trace_kfree include/trace/events/kmem.h:94 [inline]
kfree+0x6a5/0xa30 mm/slub.c:4377
bpf_free_used_maps kernel/bpf/core.c:2723 [inline]
bpf_prog_free_deferred+0x390/0xc70 kernel/bpf/core.c:2761
process_one_work kernel/workqueue.c:3254 [inline]
process_scheduled_works+0xa81/0x1bd0 kernel/workqueue.c:3335
worker_thread+0xea5/0x1560 kernel/workqueue.c:3416
kthread+0x3e2/0x540 kernel/kthread.c:388
ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
Local variable stack created at:
__bpf_prog_run96+0x45/0xe0 kernel/bpf/core.c:2236
bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline]
__bpf_prog_run include/linux/filter.h:657 [inline]
bpf_prog_run include/linux/filter.h:664 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2381 [inline]
bpf_trace_run2+0x116/0x300 kernel/trace/bpf_trace.c:2420
CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 6.9.0-rc1-syzkaller-00178-g317c7bc0ef03 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: events bpf_prog_free_deferred
=====================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
next prev parent reply other threads:[~2024-03-29 19:52 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-26 19:00 [syzbot] [bpf?] KMSAN: uninit-value in trie_delete_elem syzbot
2024-03-29 19:52 ` syzbot [this message]
2024-04-01 18:55 ` Yonghong Song
2024-04-02 6:36 ` Aleksandr Nogikh
2024-04-03 3:59 ` Yonghong Song
2024-04-03 8:47 ` Aleksandr Nogikh
2024-04-04 19:00 ` Yonghong Song
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000486e1f0614d1fa5f@google.com \
--to=syzbot+603bcd9b0bf1d94dbb9b@syzkaller.appspotmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=haoluo@google.com \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=kernel-team@meta.com \
--cc=kpsingh@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=patchwork-bot@kernel.org \
--cc=sdf@google.com \
--cc=song@kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.