From: syzbot <syzbot+fb4362a104d45ab09cf9@syzkaller.appspotmail.com>
To: abbotti@mev.co.uk, hsweeten@visionengravers.com,
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [comedi?] KMSAN: kernel-infoleak in do_insnlist_ioctl
Date: Thu, 31 Jul 2025 00:29:38 -0700 [thread overview]
Message-ID: <688b1b62.a00a0220.26d0e1.0039.GAE@google.com> (raw)
In-Reply-To: <687e955c.a70a0220.21b99c.0001.GAE@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: e8d780dcd957 Merge tag 'slab-for-6.17' of git://git.kernel..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=154b8f82580000
kernel config: https://syzkaller.appspot.com/x/.config?x=30a934bba3cd727
dashboard link: https://syzkaller.appspot.com/bug?extid=fb4362a104d45ab09cf9
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10a04ca2580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13a269bc580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f57c48189b63/disk-e8d780dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/5b7ee73a2a25/vmlinux-e8d780dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/e48af4e6a5c3/bzImage-e8d780dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+fb4362a104d45ab09cf9@syzkaller.appspotmail.com
comedi comedi3: 8255: I/O port conflict (0x2,4)
comedi comedi3: 8255: I/O port conflict (0x10000,4)
comedi comedi3: 8255: I/O port conflict (0x4,4)
comedi comedi3: 8255: I/O port conflict (0x4,4)
=====================================================
BUG: KMSAN: kernel-infoleak-after-free in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
BUG: KMSAN: kernel-infoleak-after-free in _inline_copy_to_user include/linux/uaccess.h:196 [inline]
BUG: KMSAN: kernel-infoleak-after-free in _copy_to_user+0xcc/0x120 lib/usercopy.c:26
instrument_copy_to_user include/linux/instrumented.h:114 [inline]
_inline_copy_to_user include/linux/uaccess.h:196 [inline]
_copy_to_user+0xcc/0x120 lib/usercopy.c:26
copy_to_user include/linux/uaccess.h:225 [inline]
do_insnlist_ioctl+0x66e/0x930 drivers/comedi/comedi_fops.c:1595
comedi_unlocked_ioctl+0x1e78/0x1f60 drivers/comedi/comedi_fops.c:2293
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:598 [inline]
__se_sys_ioctl+0x239/0x400 fs/ioctl.c:584
__x64_sys_ioctl+0x97/0xe0 fs/ioctl.c:584
x64_sys_call+0x1cbc/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:17
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was created at:
slab_free_hook mm/slub.c:2342 [inline]
slab_free mm/slub.c:4679 [inline]
kfree+0x252/0xec0 mm/slub.c:4878
tomoyo_supervisor+0xc57/0x3100 security/tomoyo/common.c:2250
tomoyo_audit_path_number_log security/tomoyo/file.c:235 [inline]
tomoyo_path_number_perm+0x4d8/0x7d0 security/tomoyo/file.c:734
tomoyo_file_ioctl+0x3d/0x50 security/tomoyo/tomoyo.c:350
security_file_ioctl+0x141/0x590 security/security.c:2943
__do_sys_ioctl fs/ioctl.c:592 [inline]
__se_sys_ioctl+0xbb/0x400 fs/ioctl.c:584
__x64_sys_ioctl+0x97/0xe0 fs/ioctl.c:584
x64_sys_call+0x1cbc/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:17
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Bytes 4-583 of 584 are uninitialized
Memory access of size 584 starts at ffff88814448f800
CPU: 1 UID: 0 PID: 5809 Comm: syz-executor572 Not tainted 6.16.0-syzkaller-06699-ge8d780dcd957 #0 PREEMPT(none)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
=====================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
next prev parent reply other threads:[~2025-07-31 7:29 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-07-21 19:30 [syzbot] [kernel?] KMSAN: kernel-infoleak in do_insnlist_ioctl syzbot
2025-07-31 7:29 ` syzbot [this message]
2025-07-31 9:39 ` [syzbot] [comedi?] " Hillf Danton
2025-07-31 11:03 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=688b1b62.a00a0220.26d0e1.0039.GAE@google.com \
--to=syzbot+fb4362a104d45ab09cf9@syzkaller.appspotmail.com \
--cc=abbotti@mev.co.uk \
--cc=hsweeten@visionengravers.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.