[syzbot] [lsm?] [integrity?] KMSAN: uninit-value in ima_add_template_entry (3)

All of lore.kernel.org
 help / color / mirror / Atom feed

From: syzbot <syzbot+3f0b3970f154dfc95e6e@syzkaller.appspotmail.com>
To: dmitry.kasatkin@gmail.com, eric.snowberg@oracle.com,
	jmorris@namei.org,  linux-integrity@vger.kernel.org,
	linux-kernel@vger.kernel.org,
	 linux-security-module@vger.kernel.org, paul@paul-moore.com,
	 roberto.sassu@huawei.com, serge@hallyn.com,
	syzkaller-bugs@googlegroups.com,  zohar@linux.ibm.com
Subject: [syzbot] [lsm?] [integrity?] KMSAN: uninit-value in ima_add_template_entry (3)
Date: Wed, 14 May 2025 07:54:32 -0700	[thread overview]
Message-ID: <6824aea8.a00a0220.104b28.0011.GAE@google.com> (raw)

Hello,

syzbot found the following issue on:

HEAD commit:    02ddfb981de8 Merge tag 'scsi-fixes' of git://git.kernel.or..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11169670580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=9dc42c34a3f5c357
dashboard link: https://syzkaller.appspot.com/bug?extid=3f0b3970f154dfc95e6e
compiler:       Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1574d768580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/5ca57f5a3f77/disk-02ddfb98.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3f23cbc11e68/vmlinux-02ddfb98.xz
kernel image: https://storage.googleapis.com/syzbot-assets/73e63afac354/bzImage-02ddfb98.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/0afd18737aed/mount_2.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3f0b3970f154dfc95e6e@syzkaller.appspotmail.com

bcachefs (loop2): going read-write
bcachefs (loop2): done starting filesystem
=====================================================
BUG: KMSAN: uninit-value in ima_lookup_digest_entry security/integrity/ima/ima_queue.c:64 [inline]
BUG: KMSAN: uninit-value in ima_add_template_entry+0x7a5/0x8d0 security/integrity/ima/ima_queue.c:191
 ima_lookup_digest_entry security/integrity/ima/ima_queue.c:64 [inline]
 ima_add_template_entry+0x7a5/0x8d0 security/integrity/ima/ima_queue.c:191
 ima_store_template security/integrity/ima/ima_api.c:122 [inline]
 ima_store_measurement+0x388/0x970 security/integrity/ima/ima_api.c:383
 process_measurement+0x3075/0x40e0 security/integrity/ima/ima_main.c:393
 ima_file_check+0x8e/0xd0 security/integrity/ima/ima_main.c:613
 security_file_post_open+0xbf/0x530 security/security.c:3130
 do_open fs/namei.c:3882 [inline]
 path_openat+0x5ac3/0x6760 fs/namei.c:4039
 do_filp_open+0x280/0x660 fs/namei.c:4066
 do_sys_openat2+0x1bb/0x2f0 fs/open.c:1429
 do_sys_open fs/open.c:1444 [inline]
 __do_sys_openat fs/open.c:1460 [inline]
 __se_sys_openat fs/open.c:1455 [inline]
 __x64_sys_openat+0x240/0x300 fs/open.c:1455
 x64_sys_call+0x213/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:258
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd9/0x1b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

<Zero or more stacks not recorded to save memory>

Uninit was stored to memory at:
 sha256_transform lib/crypto/sha256.c:117 [inline]
 sha256_transform_blocks+0x276d/0x2880 lib/crypto/sha256.c:127
 lib_sha256_base_do_finalize include/crypto/sha256_base.h:101 [inline]
 __sha256_final lib/crypto/sha256.c:142 [inline]
 sha256_final+0x169/0x460 lib/crypto/sha256.c:148
 crypto_sha256_final+0xca/0x120 crypto/sha256_generic.c:49
 crypto_shash_final+0x72/0xa0 crypto/shash.c:58
 ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:498 [inline]
 ima_calc_file_shash security/integrity/ima/ima_crypto.c:511 [inline]
 ima_calc_file_hash+0x240a/0x3fd0 security/integrity/ima/ima_crypto.c:568
 ima_collect_measurement+0x45d/0xe60 security/integrity/ima/ima_api.c:293
 process_measurement+0x2d1a/0x40e0 security/integrity/ima/ima_main.c:385
 ima_file_check+0x8e/0xd0 security/integrity/ima/ima_main.c:613
 security_file_post_open+0xbf/0x530 security/security.c:3130
 do_open fs/namei.c:3882 [inline]
 path_openat+0x5ac3/0x6760 fs/namei.c:4039
 do_filp_open+0x280/0x660 fs/namei.c:4066
 do_sys_openat2+0x1bb/0x2f0 fs/open.c:1429
 do_sys_open fs/open.c:1444 [inline]
 __do_sys_openat fs/open.c:1460 [inline]
 __se_sys_openat fs/open.c:1455 [inline]
 __x64_sys_openat+0x240/0x300 fs/open.c:1455
 x64_sys_call+0x213/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:258
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd9/0x1b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
 sha256_transform lib/crypto/sha256.c:117 [inline]
 sha256_transform_blocks+0x276d/0x2880 lib/crypto/sha256.c:127
 lib_sha256_base_do_update include/crypto/sha256_base.h:63 [inline]
 sha256_update+0x392/0x410 lib/crypto/sha256.c:136
 crypto_sha256_update+0x35/0x60 crypto/sha256_generic.c:39
 crypto_shash_update+0x7a/0xb0 crypto/shash.c:52
 ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:491 [inline]
 ima_calc_file_shash security/integrity/ima/ima_crypto.c:511 [inline]
 ima_calc_file_hash+0x20d7/0x3fd0 security/integrity/ima/ima_crypto.c:568
 ima_collect_measurement+0x45d/0xe60 security/integrity/ima/ima_api.c:293
 process_measurement+0x2d1a/0x40e0 security/integrity/ima/ima_main.c:385
 ima_file_check+0x8e/0xd0 security/integrity/ima/ima_main.c:613
 security_file_post_open+0xbf/0x530 security/security.c:3130
 do_open fs/namei.c:3882 [inline]
 path_openat+0x5ac3/0x6760 fs/namei.c:4039
 do_filp_open+0x280/0x660 fs/namei.c:4066
 do_sys_openat2+0x1bb/0x2f0 fs/open.c:1429
 do_sys_open fs/open.c:1444 [inline]
 __do_sys_openat fs/open.c:1460 [inline]
 __se_sys_openat fs/open.c:1455 [inline]
 __x64_sys_openat+0x240/0x300 fs/open.c:1455
 x64_sys_call+0x213/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:258
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd9/0x1b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
 BLEND_OP lib/crypto/sha256.c:61 [inline]
 sha256_transform lib/crypto/sha256.c:91 [inline]
 sha256_transform_blocks+0xded/0x2880 lib/crypto/sha256.c:127
 lib_sha256_base_do_update include/crypto/sha256_base.h:63 [inline]
 sha256_update+0x392/0x410 lib/crypto/sha256.c:136
 crypto_sha256_update+0x35/0x60 crypto/sha256_generic.c:39
 crypto_shash_update+0x7a/0xb0 crypto/shash.c:52
 ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:491 [inline]
 ima_calc_file_shash security/integrity/ima/ima_crypto.c:511 [inline]
 ima_calc_file_hash+0x20d7/0x3fd0 security/integrity/ima/ima_crypto.c:568
 ima_collect_measurement+0x45d/0xe60 security/integrity/ima/ima_api.c:293
 process_measurement+0x2d1a/0x40e0 security/integrity/ima/ima_main.c:385
 ima_file_check+0x8e/0xd0 security/integrity/ima/ima_main.c:613
 security_file_post_open+0xbf/0x530 security/security.c:3130
 do_open fs/namei.c:3882 [inline]
 path_openat+0x5ac3/0x6760 fs/namei.c:4039
 do_filp_open+0x280/0x660 fs/namei.c:4066
 do_sys_openat2+0x1bb/0x2f0 fs/open.c:1429
 do_sys_open fs/open.c:1444 [inline]
 __do_sys_openat fs/open.c:1460 [inline]
 __se_sys_openat fs/open.c:1455 [inline]
 __x64_sys_openat+0x240/0x300 fs/open.c:1455
 x64_sys_call+0x213/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:258
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd9/0x1b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
 BLEND_OP lib/crypto/sha256.c:61 [inline]
 sha256_transform lib/crypto/sha256.c:92 [inline]
 sha256_transform_blocks+0xe00/0x2880 lib/crypto/sha256.c:127
 lib_sha256_base_do_update include/crypto/sha256_base.h:63 [inline]
 sha256_update+0x392/0x410 lib/crypto/sha256.c:136
 crypto_sha256_update+0x35/0x60 crypto/sha256_generic.c:39
 crypto_shash_update+0x7a/0xb0 crypto/shash.c:52
 ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:491 [inline]
 ima_calc_file_shash security/integrity/ima/ima_crypto.c:511 [inline]
 ima_calc_file_hash+0x20d7/0x3fd0 security/integrity/ima/ima_crypto.c:568
 ima_collect_measurement+0x45d/0xe60 security/integrity/ima/ima_api.c:293
 process_measurement+0x2d1a/0x40e0 security/integrity/ima/ima_main.c:385
 ima_file_check+0x8e/0xd0 security/integrity/ima/ima_main.c:613
 security_file_post_open+0xbf/0x530 security/security.c:3130
 do_open fs/namei.c:3882 [inline]
 path_openat+0x5ac3/0x6760 fs/namei.c:4039
 do_filp_open+0x280/0x660 fs/namei.c:4066
 do_sys_openat2+0x1bb/0x2f0 fs/open.c:1429
 do_sys_open fs/open.c:1444 [inline]
 __do_sys_openat fs/open.c:1460 [inline]
 __se_sys_openat fs/open.c:1455 [inline]
 __x64_sys_openat+0x240/0x300 fs/open.c:1455
 x64_sys_call+0x213/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:258
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd9/0x1b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
 BLEND_OP lib/crypto/sha256.c:61 [inline]
 sha256_transform lib/crypto/sha256.c:93 [inline]
 sha256_transform_blocks+0xe15/0x2880 lib/crypto/sha256.c:127
 lib_sha256_base_do_update include/crypto/sha256_base.h:63 [inline]
 sha256_update+0x392/0x410 lib/crypto/sha256.c:136
 crypto_sha256_update+0x35/0x60 crypto/sha256_generic.c:39
 crypto_shash_update+0x7a/0xb0 crypto/shash.c:52
 ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:491 [inline]
 ima_calc_file_shash security/integrity/ima/ima_crypto.c:511 [inline]
 ima_calc_file_hash+0x20d7/0x3fd0 security/integrity/ima/ima_crypto.c:568
 ima_collect_measurement+0x45d/0xe60 security/integrity/ima/ima_api.c:293
 process_measurement+0x2d1a/0x40e0 security/integrity/ima/ima_main.c:385
 ima_file_check+0x8e/0xd0 security/integrity/ima/ima_main.c:613
 security_file_post_open+0xbf/0x530 security/security.c:3130
 do_open fs/namei.c:3882 [inline]
 path_openat+0x5ac3/0x6760 fs/namei.c:4039
 do_filp_open+0x280/0x660 fs/namei.c:4066
 do_sys_openat2+0x1bb/0x2f0 fs/open.c:1429
 do_sys_open fs/open.c:1444 [inline]
 __do_sys_openat fs/open.c:1460 [inline]
 __se_sys_openat fs/open.c:1455 [inline]
 __x64_sys_openat+0x240/0x300 fs/open.c:1455
 x64_sys_call+0x213/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:258
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd9/0x1b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
 LOAD_OP lib/crypto/sha256.c:56 [inline]
 sha256_transform lib/crypto/sha256.c:82 [inline]
 sha256_transform_blocks+0x268b/0x2880 lib/crypto/sha256.c:127
 lib_sha256_base_do_update include/crypto/sha256_base.h:63 [inline]
 sha256_update+0x392/0x410 lib/crypto/sha256.c:136
 crypto_sha256_update+0x35/0x60 crypto/sha256_generic.c:39
 crypto_shash_update+0x7a/0xb0 crypto/shash.c:52
 ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:491 [inline]
 ima_calc_file_shash security/integrity/ima/ima_crypto.c:511 [inline]
 ima_calc_file_hash+0x20d7/0x3fd0 security/integrity/ima/ima_crypto.c:568
 ima_collect_measurement+0x45d/0xe60 security/integrity/ima/ima_api.c:293
 process_measurement+0x2d1a/0x40e0 security/integrity/ima/ima_main.c:385
 ima_file_check+0x8e/0xd0 security/integrity/ima/ima_main.c:613
 security_file_post_open+0xbf/0x530 security/security.c:3130
 do_open fs/namei.c:3882 [inline]
 path_openat+0x5ac3/0x6760 fs/namei.c:4039
 do_filp_open+0x280/0x660 fs/namei.c:4066
 do_sys_openat2+0x1bb/0x2f0 fs/open.c:1429
 do_sys_open fs/open.c:1444 [inline]
 __do_sys_openat fs/open.c:1460 [inline]
 __se_sys_openat fs/open.c:1455 [inline]
 __x64_sys_openat+0x240/0x300 fs/open.c:1455
 x64_sys_call+0x213/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:258
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd9/0x1b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
 memcpy_to_iter lib/iov_iter.c:65 [inline]
 iterate_kvec include/linux/iov_iter.h:86 [inline]
 iterate_and_advance2 include/linux/iov_iter.h:306 [inline]
 iterate_and_advance include/linux/iov_iter.h:328 [inline]
 _copy_to_iter+0x176c/0x32f0 lib/iov_iter.c:185
 copy_page_to_iter+0x43c/0x8b0 lib/iov_iter.c:362
 copy_folio_to_iter include/linux/uio.h:198 [inline]
 filemap_read+0xced/0x2190 mm/filemap.c:2753
 bch2_read_iter+0x559/0x21c0 fs/bcachefs/fs-io-direct.c:221
 __kernel_read+0x750/0xda0 fs/read_write.c:528
 integrity_kernel_read+0x77/0x90 security/integrity/iint.c:28
 ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:480 [inline]
 ima_calc_file_shash security/integrity/ima/ima_crypto.c:511 [inline]
 ima_calc_file_hash+0x1ff9/0x3fd0 security/integrity/ima/ima_crypto.c:568
 ima_collect_measurement+0x45d/0xe60 security/integrity/ima/ima_api.c:293
 process_measurement+0x2d1a/0x40e0 security/integrity/ima/ima_main.c:385
 ima_file_check+0x8e/0xd0 security/integrity/ima/ima_main.c:613
 security_file_post_open+0xbf/0x530 security/security.c:3130
 do_open fs/namei.c:3882 [inline]
 path_openat+0x5ac3/0x6760 fs/namei.c:4039
 do_filp_open+0x280/0x660 fs/namei.c:4066
 do_sys_openat2+0x1bb/0x2f0 fs/open.c:1429
 do_sys_open fs/open.c:1444 [inline]
 __do_sys_openat fs/open.c:1460 [inline]
 __se_sys_openat fs/open.c:1455 [inline]
 __x64_sys_openat+0x240/0x300 fs/open.c:1455
 x64_sys_call+0x213/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:258
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd9/0x1b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
 __alloc_frozen_pages_noprof+0x689/0xf00 mm/page_alloc.c:4993
 alloc_pages_mpol+0x328/0x860 mm/mempolicy.c:2301
 alloc_frozen_pages_noprof mm/mempolicy.c:2372 [inline]
 alloc_pages_noprof mm/mempolicy.c:2392 [inline]
 folio_alloc_noprof+0x109/0x360 mm/mempolicy.c:2402
 filemap_alloc_folio_noprof+0x9d/0x420 mm/filemap.c:1007
 ractl_alloc_folio mm/readahead.c:186 [inline]
 ra_alloc_folio mm/readahead.c:441 [inline]
 page_cache_ra_order+0x93f/0x14f0 mm/readahead.c:509
 page_cache_sync_ra+0x108a/0x13e0 mm/readahead.c:621
 filemap_get_pages+0xfb3/0x3a70 mm/filemap.c:2591
 filemap_read+0x5c6/0x2190 mm/filemap.c:2702
 bch2_read_iter+0x559/0x21c0 fs/bcachefs/fs-io-direct.c:221
 __kernel_read+0x750/0xda0 fs/read_write.c:528
 integrity_kernel_read+0x77/0x90 security/integrity/iint.c:28
 ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:480 [inline]
 ima_calc_file_shash security/integrity/ima/ima_crypto.c:511 [inline]
 ima_calc_file_hash+0x1ff9/0x3fd0 security/integrity/ima/ima_crypto.c:568
 ima_collect_measurement+0x45d/0xe60 security/integrity/ima/ima_api.c:293
 process_measurement+0x2d1a/0x40e0 security/integrity/ima/ima_main.c:385
 ima_file_check+0x8e/0xd0 security/integrity/ima/ima_main.c:613
 security_file_post_open+0xbf/0x530 security/security.c:3130
 do_open fs/namei.c:3882 [inline]
 path_openat+0x5ac3/0x6760 fs/namei.c:4039
 do_filp_open+0x280/0x660 fs/namei.c:4066
 do_sys_openat2+0x1bb/0x2f0 fs/open.c:1429
 do_sys_open fs/open.c:1444 [inline]
 __do_sys_openat fs/open.c:1460 [inline]
 __se_sys_openat fs/open.c:1455 [inline]
 __x64_sys_openat+0x240/0x300 fs/open.c:1455
 x64_sys_call+0x213/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:258
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd9/0x1b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 0 UID: 0 PID: 7337 Comm: syz.2.106 Not tainted 6.15.0-rc3-syzkaller-00094-g02ddfb981de8 #0 PREEMPT(undef) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
=====================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

next             reply	other threads:[~2025-05-14 14:54 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-05-14 14:54 syzbot [this message]
2025-05-15 14:06 ` [syzbot] [lsm?] [integrity?] KMSAN: uninit-value in ima_add_template_entry (3) Roberto Sassu
2025-05-15 14:18   ` Kent Overstreet
2025-05-15 14:30     ` Roberto Sassu
2025-05-15 16:37       ` Kent Overstreet
2025-05-15 16:39         ` Roberto Sassu
2025-05-15 16:48           ` Kent Overstreet
2025-05-15 16:52             ` Roberto Sassu

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=6824aea8.a00a0220.104b28.0011.GAE@google.com \
    --to=syzbot+3f0b3970f154dfc95e6e@syzkaller.appspotmail.com \
    --cc=dmitry.kasatkin@gmail.com \
    --cc=eric.snowberg@oracle.com \
    --cc=jmorris@namei.org \
    --cc=linux-integrity@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=paul@paul-moore.com \
    --cc=roberto.sassu@huawei.com \
    --cc=serge@hallyn.com \
    --cc=syzkaller-bugs@googlegroups.com \
    --cc=zohar@linux.ibm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Be sure your reply has a Subject: header at the top and a blank line before the message body.

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.