From: syzbot <syzbot+ad1b8c404f0959c4bfcc@syzkaller.appspotmail.com>
To: akpm@linux-foundation.org, glider@google.com,
linux-kernel@vger.kernel.org, linux-mm@kvack.org,
syzkaller-bugs@googlegroups.com
Subject: [syzbot] KMSAN: uninit-value in mpol_rebind_mm (2)
Date: Fri, 11 Feb 2022 01:07:17 -0800 [thread overview]
Message-ID: <000000000000bf60b605d7ba64b2@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: 85cfd6e539bd kmsan: core: delete kmsan_gup_pgd_range()
git tree: https://github.com/google/kmsan.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=17a505dc700000
kernel config: https://syzkaller.appspot.com/x/.config?x=b9807dd5b044fd7a
dashboard link: https://syzkaller.appspot.com/bug?extid=ad1b8c404f0959c4bfcc
compiler: clang version 14.0.0 (/usr/local/google/src/llvm-git-monorepo 2b554920f11c8b763cd9ed9003f4e19b919b8e1f), GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10bcfdb2700000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=124ca21c700000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ad1b8c404f0959c4bfcc@syzkaller.appspotmail.com
=====================================================
BUG: KMSAN: uninit-value in mpol_rebind_policy mm/mempolicy.c:352 [inline]
BUG: KMSAN: uninit-value in mpol_rebind_mm+0x35b/0x460 mm/mempolicy.c:383
mpol_rebind_policy mm/mempolicy.c:352 [inline]
mpol_rebind_mm+0x35b/0x460 mm/mempolicy.c:383
cpuset_attach+0xe28/0x15e0 kernel/cgroup/cpuset.c:2291
cgroup_migrate_execute+0x1023/0x1d20 kernel/cgroup/cgroup.c:2515
cgroup_migrate kernel/cgroup/cgroup.c:2771 [inline]
cgroup_attach_task+0x540/0x8b0 kernel/cgroup/cgroup.c:2804
__cgroup1_procs_write+0x5cc/0x7a0 kernel/cgroup/cgroup-v1.c:520
cgroup1_procs_write+0x97/0xb0 kernel/cgroup/cgroup-v1.c:533
cgroup_file_write+0x4c2/0x9e0 kernel/cgroup/cgroup.c:3852
kernfs_fop_write_iter+0x66a/0x9f0 fs/kernfs/file.c:296
call_write_iter include/linux/fs.h:2162 [inline]
new_sync_write fs/read_write.c:503 [inline]
vfs_write+0x1318/0x2030 fs/read_write.c:590
ksys_write+0x28b/0x510 fs/read_write.c:643
__do_sys_write fs/read_write.c:655 [inline]
__se_sys_write fs/read_write.c:652 [inline]
__x64_sys_write+0xdb/0x120 fs/read_write.c:652
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x44/0xae
Uninit was stored to memory at:
__mpol_dup+0x107/0x480 mm/mempolicy.c:2326
mpol_dup include/linux/mempolicy.h:87 [inline]
vma_replace_policy mm/mempolicy.c:762 [inline]
mbind_range+0x13ee/0x1e40 mm/mempolicy.c:833
do_mbind+0x13d2/0x1b30 mm/mempolicy.c:1323
kernel_mbind mm/mempolicy.c:1477 [inline]
__do_sys_mbind mm/mempolicy.c:1484 [inline]
__se_sys_mbind+0x51c/0xc80 mm/mempolicy.c:1480
__x64_sys_mbind+0x19d/0x200 mm/mempolicy.c:1480
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x44/0xae
Uninit was created at:
slab_post_alloc_hook mm/slab.h:524 [inline]
slab_alloc_node mm/slub.c:3251 [inline]
slab_alloc mm/slub.c:3259 [inline]
kmem_cache_alloc+0x902/0x11c0 mm/slub.c:3264
mpol_new mm/mempolicy.c:293 [inline]
do_mbind+0x8f5/0x1b30 mm/mempolicy.c:1279
kernel_mbind mm/mempolicy.c:1477 [inline]
__do_sys_mbind mm/mempolicy.c:1484 [inline]
__se_sys_mbind+0x51c/0xc80 mm/mempolicy.c:1480
__x64_sys_mbind+0x19d/0x200 mm/mempolicy.c:1480
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x44/0xae
CPU: 0 PID: 3474 Comm: syz-executor399 Not tainted 5.16.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
=====================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
reply other threads:[~2022-02-11 9:07 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000bf60b605d7ba64b2@google.com \
--to=syzbot+ad1b8c404f0959c4bfcc@syzkaller.appspotmail.com \
--cc=akpm@linux-foundation.org \
--cc=glider@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.