All of lore.kernel.org
 help / color / mirror / Atom feed
From: syzbot <syzbot+f8e9a371388aa62ecab4@syzkaller.appspotmail.com>
To: asml.silence@gmail.com, axboe@kernel.dk,
	io-uring@vger.kernel.org,  linux-kernel@vger.kernel.org,
	syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [io-uring?] KMSAN: uninit-value in io_sendrecv_fail
Date: Sat, 16 Mar 2024 09:29:02 -0700	[thread overview]
Message-ID: <0000000000004db6840613c99fc6@google.com> (raw)
In-Reply-To: <6e00b097-99db-44dc-a87b-08925c1f044d@kernel.dk>

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: uninit-value in io_sendrecv_fail

=====================================================
BUG: KMSAN: uninit-value in io_sendrecv_fail+0x91/0x1e0 io_uring/net.c:1334
 io_sendrecv_fail+0x91/0x1e0 io_uring/net.c:1334
 io_req_defer_failed+0x456/0x6d0 io_uring/io_uring.c:1050
 io_queue_sqe_fallback+0x1e3/0x280 io_uring/io_uring.c:2126
 io_submit_fail_init+0x4e1/0x790 io_uring/io_uring.c:2310
 io_submit_sqes+0x1a60/0x3030 io_uring/io_uring.c:2486
 __do_sys_io_uring_enter io_uring/io_uring.c:3662 [inline]
 __se_sys_io_uring_enter+0x409/0x4390 io_uring/io_uring.c:3597
 __x64_sys_io_uring_enter+0x11b/0x1a0 io_uring/io_uring.c:3597
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x63/0x6b

Uninit was created at:
 __alloc_pages+0x9a6/0xe00 mm/page_alloc.c:4592
 __alloc_pages_node include/linux/gfp.h:238 [inline]
 alloc_pages_node include/linux/gfp.h:261 [inline]
 alloc_slab_page mm/slub.c:2190 [inline]
 allocate_slab mm/slub.c:2354 [inline]
 new_slab+0x2d7/0x1400 mm/slub.c:2407
 ___slab_alloc+0x16b5/0x3970 mm/slub.c:3540
 __kmem_cache_alloc_bulk mm/slub.c:4574 [inline]
 kmem_cache_alloc_bulk+0x52a/0x1440 mm/slub.c:4648
 __io_alloc_req_refill+0x248/0x780 io_uring/io_uring.c:1101
 io_alloc_req io_uring/io_uring.h:405 [inline]
 io_submit_sqes+0xaa2/0x3030 io_uring/io_uring.c:2475
 __do_sys_io_uring_enter io_uring/io_uring.c:3662 [inline]
 __se_sys_io_uring_enter+0x409/0x4390 io_uring/io_uring.c:3597
 __x64_sys_io_uring_enter+0x11b/0x1a0 io_uring/io_uring.c:3597
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x63/0x6b

CPU: 0 PID: 5478 Comm: syz-executor.0 Not tainted 6.8.0-syzkaller-00721-g3fdefe13e0a9 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
=====================================================


Tested on:

commit:         3fdefe13 io_uring: explicitly flag early request failure
git tree:       git://git.kernel.dk/linux.git io_uring-6.9
console output: https://syzkaller.appspot.com/x/log.txt?x=15c58006180000
kernel config:  https://syzkaller.appspot.com/x/.config?x=a271c5dca0ff14df
dashboard link: https://syzkaller.appspot.com/bug?extid=f8e9a371388aa62ecab4
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

Note: no patches were applied.

  reply	other threads:[~2024-03-16 16:29 UTC|newest]

Thread overview: 17+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-03-15 22:28 [syzbot] [io-uring?] KMSAN: uninit-value in io_sendrecv_fail syzbot
2024-03-15 22:38 ` Jens Axboe
2024-03-16  7:41   ` syzbot
2024-03-16 13:13   ` Jens Axboe
2024-03-16 13:37     ` syzbot
2024-03-16 14:42       ` Jens Axboe
2024-03-16 15:20         ` syzbot
2024-03-16 15:28       ` Pavel Begunkov
2024-03-16 15:46         ` Jens Axboe
2024-03-16 16:01   ` Jens Axboe
2024-03-16 16:29     ` syzbot [this message]
2024-03-16 16:36       ` Jens Axboe
2024-03-16 17:18         ` syzbot
2024-03-16  3:48 ` Edward Adam Davis
2024-03-16 10:26   ` syzbot
2024-03-16 12:42 ` [PATCH] io_uring: fix " Edward Adam Davis
2024-03-16 13:11   ` Jens Axboe

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=0000000000004db6840613c99fc6@google.com \
    --to=syzbot+f8e9a371388aa62ecab4@syzkaller.appspotmail.com \
    --cc=asml.silence@gmail.com \
    --cc=axboe@kernel.dk \
    --cc=io-uring@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=syzkaller-bugs@googlegroups.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.