From: syzbot <syzbot+9c0d9ba56264f1602420@syzkaller.appspotmail.com>
To: davem@davemloft.net, herbert@gondor.apana.org.au,
linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: [syzbot] [crypto?] KMSAN: uninit-value in chksum_update
Date: Tue, 09 Jan 2024 10:20:30 -0800 [thread overview]
Message-ID: <000000000000970711060e875e50@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: 453f5db0619e Merge tag 'trace-v6.7-rc7' of git://git.kerne..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=127054ade80000
kernel config: https://syzkaller.appspot.com/x/.config?x=d4130d4bb32c48ef
dashboard link: https://syzkaller.appspot.com/bug?extid=9c0d9ba56264f1602420
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/09f8d17b45e5/disk-453f5db0.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/384c334e26ee/vmlinux-453f5db0.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c93513aa17de/bzImage-453f5db0.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9c0d9ba56264f1602420@syzkaller.appspotmail.com
EXT4-fs error (device loop4): __ext4_ext_dirty:202: inode #2: comm syz-executor.4: mark_inode_dirty error
=====================================================
BUG: KMSAN: uninit-value in chksum_update+0xae/0xd0 crypto/crc32c_generic.c:88
chksum_update+0xae/0xd0 crypto/crc32c_generic.c:88
crypto_shash_update+0x75/0xa0 crypto/shash.c:74
ext4_chksum fs/ext4/ext4.h:2474 [inline]
ext4_dirblock_csum fs/ext4/namei.c:382 [inline]
ext4_dirblock_csum_set fs/ext4/namei.c:430 [inline]
ext4_handle_dirty_dirblock+0x6d5/0x8d0 fs/ext4/namei.c:438
add_dirent_to_buf+0x885/0x9f0 fs/ext4/namei.c:2215
ext4_add_entry+0xcc2/0x1b30 fs/ext4/namei.c:2447
ext4_mkdir+0xaae/0x1510 fs/ext4/namei.c:3031
vfs_mkdir+0x49a/0x700 fs/namei.c:4106
do_mkdirat+0x529/0x800 fs/namei.c:4129
__do_sys_mkdir fs/namei.c:4149 [inline]
__se_sys_mkdir fs/namei.c:4147 [inline]
__x64_sys_mkdir+0xa1/0xe0 fs/namei.c:4147
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
Uninit was stored to memory at:
ext4_chksum fs/ext4/ext4.h:2472 [inline]
ext4_dirblock_csum fs/ext4/namei.c:382 [inline]
ext4_dirblock_csum_set fs/ext4/namei.c:430 [inline]
ext4_handle_dirty_dirblock+0x7d5/0x8d0 fs/ext4/namei.c:438
add_dirent_to_buf+0x885/0x9f0 fs/ext4/namei.c:2215
ext4_add_entry+0xcc2/0x1b30 fs/ext4/namei.c:2447
ext4_mkdir+0xaae/0x1510 fs/ext4/namei.c:3031
vfs_mkdir+0x49a/0x700 fs/namei.c:4106
do_mkdirat+0x529/0x800 fs/namei.c:4129
__do_sys_mkdir fs/namei.c:4149 [inline]
__se_sys_mkdir fs/namei.c:4147 [inline]
__x64_sys_mkdir+0xa1/0xe0 fs/namei.c:4147
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
Uninit was created at:
__alloc_pages+0x9a4/0xe00 mm/page_alloc.c:4591
alloc_pages_mpol+0x62b/0x9d0 mm/mempolicy.c:2133
alloc_pages+0x1be/0x1e0 mm/mempolicy.c:2204
alloc_slab_page mm/slub.c:1870 [inline]
allocate_slab mm/slub.c:2017 [inline]
new_slab+0x421/0x1570 mm/slub.c:2070
___slab_alloc+0x13db/0x33d0 mm/slub.c:3223
__slab_alloc mm/slub.c:3322 [inline]
__slab_alloc_node mm/slub.c:3375 [inline]
slab_alloc_node mm/slub.c:3468 [inline]
slab_alloc mm/slub.c:3486 [inline]
__kmem_cache_alloc_lru mm/slub.c:3493 [inline]
kmem_cache_alloc_lru+0x552/0x970 mm/slub.c:3509
alloc_inode_sb include/linux/fs.h:2937 [inline]
ext4_alloc_inode+0x63/0x850 fs/ext4/super.c:1408
alloc_inode+0x83/0x440 fs/inode.c:261
new_inode_pseudo fs/inode.c:1006 [inline]
new_inode+0x38/0x420 fs/inode.c:1032
__ext4_new_inode+0x297/0x79b0 fs/ext4/ialloc.c:958
ext4_symlink+0x57e/0x1440 fs/ext4/namei.c:3398
vfs_symlink+0x1e6/0x3e0 fs/namei.c:4464
do_symlinkat+0x257/0x890 fs/namei.c:4490
__do_sys_symlinkat fs/namei.c:4506 [inline]
__se_sys_symlinkat fs/namei.c:4503 [inline]
__x64_sys_symlinkat+0xf8/0x160 fs/namei.c:4503
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
CPU: 0 PID: 5681 Comm: syz-executor.4 Not tainted 6.7.0-rc7-syzkaller-00049-g453f5db0619e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
=====================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
reply other threads:[~2024-01-09 18:20 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000970711060e875e50@google.com \
--to=syzbot+9c0d9ba56264f1602420@syzkaller.appspotmail.com \
--cc=davem@davemloft.net \
--cc=herbert@gondor.apana.org.au \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.