From: syzbot <syzbot+31a641689d43387f05d3@syzkaller.appspotmail.com>
To: glider@google.com, gregkh@linuxfoundation.org, jslaby@suse.com,
jwilk@jwilk.net, linux-kernel@vger.kernel.org, nico@fluxnic.net,
syzkaller-bugs@googlegroups.com
Subject: KMSAN: kernel-infoleak in vcs_read (2)
Date: Wed, 04 Dec 2019 07:25:07 -0800 [thread overview]
Message-ID: <000000000000eca3eb0598e26a3d@google.com> (raw)
Hello,
syzbot found the following crash on:
HEAD commit: 141b13f7 fixup "kmsan: ext4: skip block merging logic "
git tree: https://github.com/google/kmsan.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=1201f061e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=fde150fb1e865232
dashboard link: https://syzkaller.appspot.com/bug?extid=31a641689d43387f05d3
compiler: clang version 9.0.0 (/home/glider/llvm/clang
80fee25776c2fb61e74c1ecb1a523375c2500b69)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+31a641689d43387f05d3@syzkaller.appspotmail.com
=====================================================
BUG: KMSAN: kernel-infoleak in kmsan_copy_to_user+0xa9/0xb0
mm/kmsan/kmsan_hooks.c:257
CPU: 0 PID: 18848 Comm: syz-executor.5 Not tainted 5.4.0-rc8-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1c9/0x220 lib/dump_stack.c:118
kmsan_report+0x128/0x220 mm/kmsan/kmsan_report.c:108
kmsan_internal_check_memory+0x215/0x440 mm/kmsan/kmsan.c:455
kmsan_copy_to_user+0xa9/0xb0 mm/kmsan/kmsan_hooks.c:257
_copy_to_user+0x16b/0x1f0 lib/usercopy.c:33
copy_to_user include/linux/uaccess.h:174 [inline]
vcs_read+0x1edb/0x22e0 drivers/tty/vt/vc_screen.c:424
do_loop_readv_writev fs/read_write.c:714 [inline]
do_iter_read+0x8e0/0xe10 fs/read_write.c:935
vfs_readv fs/read_write.c:997 [inline]
do_readv+0x37f/0x710 fs/read_write.c:1034
__do_sys_readv fs/read_write.c:1125 [inline]
__se_sys_readv+0x9b/0xb0 fs/read_write.c:1122
__x64_sys_readv+0x4a/0x70 fs/read_write.c:1122
do_syscall_64+0xb6/0x160 arch/x86/entry/common.c:291
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45a679
Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fbb48b2cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000013
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a679
RDX: 0000000000000002 RSI: 0000000020000180 RDI: 0000000000000003
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fbb48b2d6d4
R13: 00000000004c89bc R14: 00000000004e0408 R15: 00000000ffffffff
Uninit was stored to memory at:
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:149 [inline]
kmsan_internal_chain_origin+0xb9/0x170 mm/kmsan/kmsan.c:317
kmsan_memcpy_memmove_metadata+0x25c/0x2e0 mm/kmsan/kmsan.c:252
kmsan_memcpy_metadata+0xb/0x10 mm/kmsan/kmsan.c:272
__msan_memcpy+0x56/0x70 mm/kmsan/kmsan_instr.c:129
vc_uniscr_copy_line+0x4ce/0x750 drivers/tty/vt/vt.c:566
vcs_read+0xd37/0x22e0 drivers/tty/vt/vc_screen.c:332
do_loop_readv_writev fs/read_write.c:714 [inline]
do_iter_read+0x8e0/0xe10 fs/read_write.c:935
vfs_readv fs/read_write.c:997 [inline]
do_readv+0x37f/0x710 fs/read_write.c:1034
__do_sys_readv fs/read_write.c:1125 [inline]
__se_sys_readv+0x9b/0xb0 fs/read_write.c:1122
__x64_sys_readv+0x4a/0x70 fs/read_write.c:1122
do_syscall_64+0xb6/0x160 arch/x86/entry/common.c:291
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Uninit was created at:
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:149 [inline]
kmsan_internal_poison_shadow+0x5c/0x110 mm/kmsan/kmsan.c:132
kmsan_slab_alloc+0x8a/0xe0 mm/kmsan/kmsan_hooks.c:86
slab_alloc_node mm/slub.c:2773 [inline]
slab_alloc mm/slub.c:2782 [inline]
__kmalloc+0x28b/0x410 mm/slub.c:3815
kmalloc include/linux/slab.h:561 [inline]
vc_uniscr_alloc+0xa6/0x730 drivers/tty/vt/vt.c:353
vc_do_resize+0x608/0x2b60 drivers/tty/vt/vt.c:1192
vt_resize+0x10e/0x170 drivers/tty/vt/vt.c:1325
tty_ioctl+0x2c39/0x3100 drivers/tty/tty_io.c:2503
do_vfs_ioctl+0xea8/0x2c50 fs/ioctl.c:46
ksys_ioctl fs/ioctl.c:713 [inline]
__do_sys_ioctl fs/ioctl.c:720 [inline]
__se_sys_ioctl+0x1da/0x270 fs/ioctl.c:718
__x64_sys_ioctl+0x4a/0x70 fs/ioctl.c:718
do_syscall_64+0xb6/0x160 arch/x86/entry/common.c:291
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Bytes 0-23 of 216 are uninitialized
Memory access of size 216 starts at ffff8d212e741000
Data copied to user address 0000000020000280
=====================================================
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
next reply other threads:[~2019-12-04 15:25 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-12-04 15:25 syzbot [this message]
2020-09-06 4:04 ` KMSAN: kernel-infoleak in vcs_read (2) syzbot
2022-07-19 5:49 ` [PATCH] tty: vt: initialize unicode screen buffer Tetsuo Handa
2022-07-19 6:03 ` Jiri Slaby
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000eca3eb0598e26a3d@google.com \
--to=syzbot+31a641689d43387f05d3@syzkaller.appspotmail.com \
--cc=glider@google.com \
--cc=gregkh@linuxfoundation.org \
--cc=jslaby@suse.com \
--cc=jwilk@jwilk.net \
--cc=linux-kernel@vger.kernel.org \
--cc=nico@fluxnic.net \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.