From: Martin KaFai Lau <martin.lau@linux.dev>
To: syzbot <syzbot+8ac8b7b2292ea867a162@syzkaller.appspotmail.com>,
syzkaller-bugs@googlegroups.com
Cc: alexei.starovoitov@gmail.com, andrii@kernel.org, ast@kernel.org,
bpf@vger.kernel.org, daniel@iogearbox.net, eddyz87@gmail.com,
haoluo@google.com, john.fastabend@gmail.com, jolsa@kernel.org,
kpsingh@kernel.org, linux-kernel@vger.kernel.org,
samsun1006219@gmail.com, sdf@google.com, song@kernel.org,
xrivendell7@gmail.com, yonghong.song@linux.dev
Subject: Re: [syzbot] [bpf?] KMSAN: uninit-value in __bpf_strtoull
Date: Fri, 29 Mar 2024 11:03:16 -0700 [thread overview]
Message-ID: <60264dc3-dea2-48d0-a616-ae14d7c2c14b@linux.dev> (raw)
In-Reply-To: <0000000000009925b60614c3d39d@google.com>
On 3/28/24 7:59 PM, syzbot wrote:
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 8d025e2092e2 Merge tag 'erofs-for-6.9-rc2-fixes' of git://..
> git tree: upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=10f2ffe6180000
> kernel config: https://syzkaller.appspot.com/x/.config?x=e2599baf258ef795
> dashboard link: https://syzkaller.appspot.com/bug?extid=8ac8b7b2292ea867a162
> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15b3ac29180000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=160153c9180000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/5ccde1a19e22/disk-8d025e20.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/45420817e7d9/vmlinux-8d025e20.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/354bdafd8c8f/bzImage-8d025e20.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+8ac8b7b2292ea867a162@syzkaller.appspotmail.com
>
> =====================================================
> BUG: KMSAN: uninit-value in __bpf_strtoull+0x245/0x5b0 kernel/bpf/helpers.c:465
> __bpf_strtoull+0x245/0x5b0 kernel/bpf/helpers.c:465
> __bpf_strtoll kernel/bpf/helpers.c:504 [inline]
> ____bpf_strtol kernel/bpf/helpers.c:525 [inline]
> bpf_strtol+0x7c/0x270 kernel/bpf/helpers.c:519
> ___bpf_prog_run+0x13fe/0xe0f0 kernel/bpf/core.c:1997
> __bpf_prog_run96+0xb5/0xe0 kernel/bpf/core.c:2236
This should be similar to the other KMSAN reports on the interpreter using
the uninit stack in the map_lookup/delete_elem helpers. The bpf prog used
in this C reproducer:
0: (18) r0 = 0x0
2: (b7) r8 = 0
3: (7b) *(u64 *)(r10 -72) = r8
4: (b7) r8 = 0
5: (7b) *(u64 *)(r10 -16) = r8
6: (bf) r1 = r10
7: (07) r1 += -8
^^^^^^^^
8: (bf) r4 = r10
9: (07) r4 += -16
10: (b7) r2 = 8
11: (18) r3 = map[id:68][0]+0
13: (b7) r3 = 0
14: (85) call bpf_strtol#896752
15: (95) exit
#syz fix: bpf: Mark bpf prog stack with kmsan_unposion_memory in interpreter mode
next prev parent reply other threads:[~2024-03-29 18:03 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-19 18:11 [syzbot] [bpf?] KMSAN: uninit-value in __bpf_strtoull syzbot
2024-03-29 2:59 ` syzbot
2024-03-29 18:03 ` Martin KaFai Lau [this message]
-- strict thread matches above, loose matches on Subject: below --
2024-03-21 6:41 xingwei lee
2024-03-21 6:45 ` Alexei Starovoitov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=60264dc3-dea2-48d0-a616-ae14d7c2c14b@linux.dev \
--to=martin.lau@linux.dev \
--cc=alexei.starovoitov@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=haoluo@google.com \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=kpsingh@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=samsun1006219@gmail.com \
--cc=sdf@google.com \
--cc=song@kernel.org \
--cc=syzbot+8ac8b7b2292ea867a162@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=xrivendell7@gmail.com \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.