From: syzbot <syzbot+09c915024af5057b77da@syzkaller.appspotmail.com>
To: kent.overstreet@linux.dev, linux-bcachefs@vger.kernel.org,
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_bkey_val_validate
Date: Thu, 05 Dec 2024 13:19:22 -0800 [thread overview]
Message-ID: <675218da.050a0220.b4160.01e7.GAE@google.com> (raw)
In-Reply-To: <6749f2ee.050a0220.253251.00bb.GAE@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: feffde684ac2 Merge tag 'for-6.13-rc1-tag' of git://git.ker..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1625ade8580000
kernel config: https://syzkaller.appspot.com/x/.config?x=96ee18b6611821ab
dashboard link: https://syzkaller.appspot.com/bug?extid=09c915024af5057b77da
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10a390f8580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1125ade8580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/b31883c9ce49/disk-feffde68.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/cd0fe66ddb61/vmlinux-feffde68.xz
kernel image: https://storage.googleapis.com/syzbot-assets/88e3455fb342/bzImage-feffde68.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/01cd3582aecd/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+09c915024af5057b77da@syzkaller.appspotmail.com
=====================================================
BUG: KMSAN: uninit-value in bch2_backpointer_validate+0x63a/0x8f0 fs/bcachefs/backpointers.c:57
bch2_backpointer_validate+0x63a/0x8f0 fs/bcachefs/backpointers.c:57
bch2_bkey_val_validate+0x2b5/0x440 fs/bcachefs/bkey_methods.c:143
bset_key_validate fs/bcachefs/btree_io.c:841 [inline]
validate_bset_keys+0x1531/0x2080 fs/bcachefs/btree_io.c:910
validate_bset_for_write+0x142/0x290 fs/bcachefs/btree_io.c:1942
__bch2_btree_node_write+0x53df/0x6830 fs/bcachefs/btree_io.c:2152
bch2_btree_node_write+0x256/0x2e0 fs/bcachefs/btree_io.c:2296
btree_node_write_if_need fs/bcachefs/btree_io.h:151 [inline]
__btree_node_flush+0x606/0x680 fs/bcachefs/btree_trans_commit.c:252
bch2_btree_node_flush1+0x38/0x60 fs/bcachefs/btree_trans_commit.c:266
journal_flush_pins+0xce6/0x1780 fs/bcachefs/journal_reclaim.c:565
__bch2_journal_reclaim+0xda8/0x1670 fs/bcachefs/journal_reclaim.c:698
bch2_journal_reclaim_thread+0x18e/0x760 fs/bcachefs/journal_reclaim.c:740
kthread+0x3e2/0x540 kernel/kthread.c:389
ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Uninit was stored to memory at:
memcpy_u64s_small fs/bcachefs/util.h:393 [inline]
bkey_p_copy fs/bcachefs/bkey.h:47 [inline]
bch2_sort_keys_keep_unwritten_whiteouts+0x12d5/0x19d0 fs/bcachefs/bkey_sort.c:187
__bch2_btree_node_write+0x3ae8/0x6830 fs/bcachefs/btree_io.c:2095
bch2_btree_node_write+0x256/0x2e0 fs/bcachefs/btree_io.c:2296
btree_node_write_if_need fs/bcachefs/btree_io.h:151 [inline]
__btree_node_flush+0x606/0x680 fs/bcachefs/btree_trans_commit.c:252
bch2_btree_node_flush1+0x38/0x60 fs/bcachefs/btree_trans_commit.c:266
journal_flush_pins+0xce6/0x1780 fs/bcachefs/journal_reclaim.c:565
__bch2_journal_reclaim+0xda8/0x1670 fs/bcachefs/journal_reclaim.c:698
bch2_journal_reclaim_thread+0x18e/0x760 fs/bcachefs/journal_reclaim.c:740
kthread+0x3e2/0x540 kernel/kthread.c:389
ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Uninit was created at:
___kmalloc_large_node+0x22c/0x370 mm/slub.c:4238
__kmalloc_large_node_noprof+0x3f/0x1e0 mm/slub.c:4255
__do_kmalloc_node mm/slub.c:4271 [inline]
__kmalloc_node_noprof+0xc96/0x1250 mm/slub.c:4289
__kvmalloc_node_noprof+0xc0/0x2d0 mm/util.c:650
btree_bounce_alloc fs/bcachefs/btree_io.c:124 [inline]
btree_node_sort+0x78a/0x1d30 fs/bcachefs/btree_io.c:323
bch2_btree_post_write_cleanup+0x1b0/0xf20 fs/bcachefs/btree_io.c:2248
bch2_btree_node_write+0x21c/0x2e0 fs/bcachefs/btree_io.c:2289
btree_node_write_if_need fs/bcachefs/btree_io.h:151 [inline]
__btree_node_flush+0x606/0x680 fs/bcachefs/btree_trans_commit.c:252
bch2_btree_node_flush0+0x35/0x60 fs/bcachefs/btree_trans_commit.c:261
journal_flush_pins+0xce6/0x1780 fs/bcachefs/journal_reclaim.c:565
__bch2_journal_reclaim+0xda8/0x1670 fs/bcachefs/journal_reclaim.c:698
bch2_journal_reclaim_thread+0x18e/0x760 fs/bcachefs/journal_reclaim.c:740
kthread+0x3e2/0x540 kernel/kthread.c:389
ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
CPU: 0 UID: 0 PID: 5790 Comm: bch-reclaim/loo Not tainted 6.13.0-rc1-syzkaller-00025-gfeffde684ac2 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
=====================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
next prev parent reply other threads:[~2024-12-05 21:19 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-11-29 16:59 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_bkey_val_validate syzbot
2024-12-05 21:19 ` syzbot [this message]
2025-04-01 4:02 ` [syzbot] syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=675218da.050a0220.b4160.01e7.GAE@google.com \
--to=syzbot+09c915024af5057b77da@syzkaller.appspotmail.com \
--cc=kent.overstreet@linux.dev \
--cc=linux-bcachefs@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.