* [syzbot] [v9fs?] KMSAN: uninit-value in p9_client_rpc (2)
2024-03-30 11:13 [syzbot] [v9fs?] KMSAN: uninit-value in p9_client_rpc (2) syzbot
@ 2024-03-30 11:13 ` syzbot
2024-03-30 23:49 ` Edward Adam Davis
` (3 subsequent siblings)
4 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2024-03-30 11:13 UTC (permalink / raw)
To: asmadeus, ericvh, linux-fsdevel, linux-kernel, linux_oss, lucho,
syzkaller-bugs, v9fs
Hello,
syzbot found the following issue on:
HEAD commit: 928a87efa423 Merge tag 'gfs2-v6.8-fix' of git://git.kernel..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=106cc57e180000
kernel config: https://syzkaller.appspot.com/x/.config?x=e2599baf258ef795
dashboard link: https://syzkaller.appspot.com/bug?extid=ff14db38f56329ef68df
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13a39546180000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17b4aa7e180000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7d66fa7ed5c7/disk-928a87ef.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/8b511d64cde0/vmlinux-928a87ef.xz
kernel image: https://storage.googleapis.com/syzbot-assets/8810588440a2/bzImage-928a87ef.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ff14db38f56329ef68df@syzkaller.appspotmail.com
=====================================================
BUG: KMSAN: uninit-value in trace_9p_client_res include/trace/events/9p.h:146 [inline]
BUG: KMSAN: uninit-value in p9_client_rpc+0x1314/0x1340 net/9p/client.c:754
trace_9p_client_res include/trace/events/9p.h:146 [inline]
p9_client_rpc+0x1314/0x1340 net/9p/client.c:754
p9_client_create+0x1551/0x1ff0 net/9p/client.c:1031
v9fs_session_init+0x1b9/0x28e0 fs/9p/v9fs.c:410
v9fs_mount+0xe2/0x12b0 fs/9p/vfs_super.c:122
legacy_get_tree+0x114/0x290 fs/fs_context.c:662
vfs_get_tree+0xa7/0x570 fs/super.c:1797
do_new_mount+0x71f/0x15e0 fs/namespace.c:3352
path_mount+0x742/0x1f20 fs/namespace.c:3679
do_mount fs/namespace.c:3692 [inline]
__do_sys_mount fs/namespace.c:3898 [inline]
__se_sys_mount+0x725/0x810 fs/namespace.c:3875
__x64_sys_mount+0xe4/0x150 fs/namespace.c:3875
do_syscall_64+0xd5/0x1f0
entry_SYSCALL_64_after_hwframe+0x6d/0x75
Uninit was created at:
__alloc_pages+0x9d6/0xe70 mm/page_alloc.c:4598
__alloc_pages_node include/linux/gfp.h:238 [inline]
alloc_pages_node include/linux/gfp.h:261 [inline]
alloc_slab_page mm/slub.c:2175 [inline]
allocate_slab mm/slub.c:2338 [inline]
new_slab+0x2de/0x1400 mm/slub.c:2391
___slab_alloc+0x1184/0x33d0 mm/slub.c:3525
__slab_alloc mm/slub.c:3610 [inline]
__slab_alloc_node mm/slub.c:3663 [inline]
slab_alloc_node mm/slub.c:3835 [inline]
kmem_cache_alloc+0x6d3/0xbe0 mm/slub.c:3852
p9_tag_alloc net/9p/client.c:278 [inline]
p9_client_prepare_req+0x20a/0x1770 net/9p/client.c:641
p9_client_rpc+0x27e/0x1340 net/9p/client.c:688
p9_client_create+0x1551/0x1ff0 net/9p/client.c:1031
v9fs_session_init+0x1b9/0x28e0 fs/9p/v9fs.c:410
v9fs_mount+0xe2/0x12b0 fs/9p/vfs_super.c:122
legacy_get_tree+0x114/0x290 fs/fs_context.c:662
vfs_get_tree+0xa7/0x570 fs/super.c:1797
do_new_mount+0x71f/0x15e0 fs/namespace.c:3352
path_mount+0x742/0x1f20 fs/namespace.c:3679
do_mount fs/namespace.c:3692 [inline]
__do_sys_mount fs/namespace.c:3898 [inline]
__se_sys_mount+0x725/0x810 fs/namespace.c:3875
__x64_sys_mount+0xe4/0x150 fs/namespace.c:3875
do_syscall_64+0xd5/0x1f0
entry_SYSCALL_64_after_hwframe+0x6d/0x75
CPU: 1 PID: 5017 Comm: syz-executor353 Not tainted 6.9.0-rc1-syzkaller-00005-g928a87efa423 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
=====================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: [syzbot] [v9fs?] KMSAN: uninit-value in p9_client_rpc (2)
2024-03-30 11:13 [syzbot] [v9fs?] KMSAN: uninit-value in p9_client_rpc (2) syzbot
2024-03-30 11:13 ` syzbot
@ 2024-03-30 23:49 ` Edward Adam Davis
2024-03-31 6:01 ` syzbot
2024-03-31 6:39 ` Edward Adam Davis
` (2 subsequent siblings)
4 siblings, 1 reply; 10+ messages in thread
From: Edward Adam Davis @ 2024-03-30 23:49 UTC (permalink / raw)
To: syzbot+ff14db38f56329ef68df; +Cc: linux-kernel, syzkaller-bugs
please test uv p9_client_rpc
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
diff --git a/net/9p/client.c b/net/9p/client.c
index e265a0ca6bdd..30e183b880d5 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -292,6 +292,7 @@ p9_tag_alloc(struct p9_client *c, int8_t type, uint t_size, uint r_size,
if (!req)
return ERR_PTR(-ENOMEM);
+ memset(req, 0, sizeof(req));
if (p9_fcall_init(c, &req->tc, alloc_tsize))
goto free_req;
if (p9_fcall_init(c, &req->rc, alloc_rsize))
^ permalink raw reply related [flat|nested] 10+ messages in thread* Re: [syzbot] [v9fs?] KMSAN: uninit-value in p9_client_rpc (2)
2024-03-30 23:49 ` Edward Adam Davis
@ 2024-03-31 6:01 ` syzbot
0 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2024-03-31 6:01 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: uninit-value in p9_client_rpc
=====================================================
BUG: KMSAN: uninit-value in trace_9p_client_res include/trace/events/9p.h:146 [inline]
BUG: KMSAN: uninit-value in p9_client_rpc+0x1314/0x1340 net/9p/client.c:755
trace_9p_client_res include/trace/events/9p.h:146 [inline]
p9_client_rpc+0x1314/0x1340 net/9p/client.c:755
p9_client_create+0x1551/0x1ff0 net/9p/client.c:1032
v9fs_session_init+0x1b9/0x28e0 fs/9p/v9fs.c:410
v9fs_mount+0xe2/0x12b0 fs/9p/vfs_super.c:122
legacy_get_tree+0x114/0x290 fs/fs_context.c:662
vfs_get_tree+0xa7/0x570 fs/super.c:1797
do_new_mount+0x71f/0x15e0 fs/namespace.c:3352
path_mount+0x742/0x1f20 fs/namespace.c:3679
do_mount fs/namespace.c:3692 [inline]
__do_sys_mount fs/namespace.c:3898 [inline]
__se_sys_mount+0x725/0x810 fs/namespace.c:3875
__x64_sys_mount+0xe4/0x150 fs/namespace.c:3875
do_syscall_64+0xd5/0x1f0
entry_SYSCALL_64_after_hwframe+0x72/0x7a
Uninit was created at:
__alloc_pages+0x9d6/0xe70 mm/page_alloc.c:4598
__alloc_pages_node include/linux/gfp.h:238 [inline]
alloc_pages_node include/linux/gfp.h:261 [inline]
alloc_slab_page mm/slub.c:2175 [inline]
allocate_slab mm/slub.c:2338 [inline]
new_slab+0x2de/0x1400 mm/slub.c:2391
___slab_alloc+0x1184/0x33d0 mm/slub.c:3525
__slab_alloc mm/slub.c:3610 [inline]
__slab_alloc_node mm/slub.c:3663 [inline]
slab_alloc_node mm/slub.c:3835 [inline]
kmem_cache_alloc+0x6d3/0xbe0 mm/slub.c:3852
p9_tag_alloc net/9p/client.c:278 [inline]
p9_client_prepare_req+0x210/0x17c0 net/9p/client.c:642
p9_client_rpc+0x27e/0x1340 net/9p/client.c:689
p9_client_create+0x1551/0x1ff0 net/9p/client.c:1032
v9fs_session_init+0x1b9/0x28e0 fs/9p/v9fs.c:410
v9fs_mount+0xe2/0x12b0 fs/9p/vfs_super.c:122
legacy_get_tree+0x114/0x290 fs/fs_context.c:662
vfs_get_tree+0xa7/0x570 fs/super.c:1797
do_new_mount+0x71f/0x15e0 fs/namespace.c:3352
path_mount+0x742/0x1f20 fs/namespace.c:3679
do_mount fs/namespace.c:3692 [inline]
__do_sys_mount fs/namespace.c:3898 [inline]
__se_sys_mount+0x725/0x810 fs/namespace.c:3875
__x64_sys_mount+0xe4/0x150 fs/namespace.c:3875
do_syscall_64+0xd5/0x1f0
entry_SYSCALL_64_after_hwframe+0x72/0x7a
CPU: 0 PID: 5499 Comm: syz-executor.0 Not tainted 6.9.0-rc1-syzkaller-00355-g712e14250dd2-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
=====================================================
Tested on:
commit: 712e1425 Merge tag 'xfs-6.9-fixes-1' of git://git.kern..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=12ec65b1180000
kernel config: https://syzkaller.appspot.com/x/.config?x=e2599baf258ef795
dashboard link: https://syzkaller.appspot.com/bug?extid=ff14db38f56329ef68df
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=1485fa1d180000
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] [v9fs?] KMSAN: uninit-value in p9_client_rpc (2)
2024-03-30 11:13 [syzbot] [v9fs?] KMSAN: uninit-value in p9_client_rpc (2) syzbot
2024-03-30 11:13 ` syzbot
2024-03-30 23:49 ` Edward Adam Davis
@ 2024-03-31 6:39 ` Edward Adam Davis
2024-03-31 7:16 ` syzbot
2024-04-03 13:33 ` Nikita Zhandarovich
2024-04-08 11:17 ` Edward Adam Davis
4 siblings, 1 reply; 10+ messages in thread
From: Edward Adam Davis @ 2024-03-31 6:39 UTC (permalink / raw)
To: syzbot+ff14db38f56329ef68df; +Cc: linux-kernel, syzkaller-bugs
please test uv p9_client_rpc
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
diff --git a/net/9p/client.c b/net/9p/client.c
index e265a0ca6bdd..cb5cbb150dcd 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -977,7 +977,7 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
struct p9_client *clnt;
char *client_id;
- clnt = kmalloc(sizeof(*clnt), GFP_KERNEL);
+ clnt = kzalloc(sizeof(*clnt), GFP_KERNEL);
if (!clnt)
return ERR_PTR(-ENOMEM);
^ permalink raw reply related [flat|nested] 10+ messages in thread
* Re: [syzbot] [v9fs?] KMSAN: uninit-value in p9_client_rpc (2)
2024-03-31 6:39 ` Edward Adam Davis
@ 2024-03-31 7:16 ` syzbot
0 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2024-03-31 7:16 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: uninit-value in p9_client_rpc
=====================================================
BUG: KMSAN: uninit-value in trace_9p_client_res include/trace/events/9p.h:146 [inline]
BUG: KMSAN: uninit-value in p9_client_rpc+0x1314/0x1340 net/9p/client.c:754
trace_9p_client_res include/trace/events/9p.h:146 [inline]
p9_client_rpc+0x1314/0x1340 net/9p/client.c:754
p9_client_create+0x1551/0x1ff0 net/9p/client.c:1031
v9fs_session_init+0x1b9/0x28e0 fs/9p/v9fs.c:410
v9fs_mount+0xe2/0x12b0 fs/9p/vfs_super.c:122
legacy_get_tree+0x114/0x290 fs/fs_context.c:662
vfs_get_tree+0xa7/0x570 fs/super.c:1797
do_new_mount+0x71f/0x15e0 fs/namespace.c:3352
path_mount+0x742/0x1f20 fs/namespace.c:3679
do_mount fs/namespace.c:3692 [inline]
__do_sys_mount fs/namespace.c:3898 [inline]
__se_sys_mount+0x725/0x810 fs/namespace.c:3875
__x64_sys_mount+0xe4/0x150 fs/namespace.c:3875
do_syscall_64+0xd5/0x1f0
entry_SYSCALL_64_after_hwframe+0x72/0x7a
Uninit was created at:
__alloc_pages+0x9d6/0xe70 mm/page_alloc.c:4598
__alloc_pages_node include/linux/gfp.h:238 [inline]
alloc_pages_node include/linux/gfp.h:261 [inline]
alloc_slab_page mm/slub.c:2175 [inline]
allocate_slab mm/slub.c:2338 [inline]
new_slab+0x2de/0x1400 mm/slub.c:2391
___slab_alloc+0x1184/0x33d0 mm/slub.c:3525
__slab_alloc mm/slub.c:3610 [inline]
__slab_alloc_node mm/slub.c:3663 [inline]
slab_alloc_node mm/slub.c:3835 [inline]
kmem_cache_alloc+0x6d3/0xbe0 mm/slub.c:3852
p9_tag_alloc net/9p/client.c:278 [inline]
p9_client_prepare_req+0x20a/0x1770 net/9p/client.c:641
p9_client_rpc+0x27e/0x1340 net/9p/client.c:688
p9_client_create+0x1551/0x1ff0 net/9p/client.c:1031
v9fs_session_init+0x1b9/0x28e0 fs/9p/v9fs.c:410
v9fs_mount+0xe2/0x12b0 fs/9p/vfs_super.c:122
legacy_get_tree+0x114/0x290 fs/fs_context.c:662
vfs_get_tree+0xa7/0x570 fs/super.c:1797
do_new_mount+0x71f/0x15e0 fs/namespace.c:3352
path_mount+0x742/0x1f20 fs/namespace.c:3679
do_mount fs/namespace.c:3692 [inline]
__do_sys_mount fs/namespace.c:3898 [inline]
__se_sys_mount+0x725/0x810 fs/namespace.c:3875
__x64_sys_mount+0xe4/0x150 fs/namespace.c:3875
do_syscall_64+0xd5/0x1f0
entry_SYSCALL_64_after_hwframe+0x72/0x7a
CPU: 1 PID: 5498 Comm: syz-executor.0 Not tainted 6.9.0-rc1-syzkaller-00355-g712e14250dd2-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
=====================================================
Tested on:
commit: 712e1425 Merge tag 'xfs-6.9-fixes-1' of git://git.kern..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=17bcb30d180000
kernel config: https://syzkaller.appspot.com/x/.config?x=e2599baf258ef795
dashboard link: https://syzkaller.appspot.com/bug?extid=ff14db38f56329ef68df
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=17a6421d180000
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] [v9fs?] KMSAN: uninit-value in p9_client_rpc (2)
2024-03-30 11:13 [syzbot] [v9fs?] KMSAN: uninit-value in p9_client_rpc (2) syzbot
` (2 preceding siblings ...)
2024-03-31 6:39 ` Edward Adam Davis
@ 2024-04-03 13:33 ` Nikita Zhandarovich
2024-04-04 0:34 ` syzbot
2024-04-08 11:17 ` Edward Adam Davis
4 siblings, 1 reply; 10+ messages in thread
From: Nikita Zhandarovich @ 2024-04-03 13:33 UTC (permalink / raw)
To: syzbot+ff14db38f56329ef68df
Cc: Nikita Zhandarovich, syzkaller-bugs, linux-kernel
If p9_check_errors() fails in p9_client_rpc(), req->rc.tag won't be
initialized and trace_9p_client_res() will try to print it before
exiting with error, triggering KMSAN. Fix it by having id and tag
fields inited with zero values.
Please test.
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
net/9p/client.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/9p/client.c b/net/9p/client.c
index e265a0ca6bdd..a9d613af7455 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -235,6 +235,8 @@ static int p9_fcall_init(struct p9_client *c, struct p9_fcall *fc,
if (!fc->sdata)
return -ENOMEM;
fc->capacity = alloc_msize;
+ fc->id = 0;
+ fc->tag = 0;
return 0;
}
^ permalink raw reply related [flat|nested] 10+ messages in thread* Re: [syzbot] [v9fs?] KMSAN: uninit-value in p9_client_rpc (2)
2024-03-30 11:13 [syzbot] [v9fs?] KMSAN: uninit-value in p9_client_rpc (2) syzbot
` (3 preceding siblings ...)
2024-04-03 13:33 ` Nikita Zhandarovich
@ 2024-04-08 11:17 ` Edward Adam Davis
2024-04-08 21:41 ` syzbot
4 siblings, 1 reply; 10+ messages in thread
From: Edward Adam Davis @ 2024-04-08 11:17 UTC (permalink / raw)
To: syzbot+ff14db38f56329ef68df; +Cc: linux-kernel, syzkaller-bugs
please test uv p9_client_rpc
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
diff --git a/net/9p/client.c b/net/9p/client.c
index e265a0ca6bdd..cd525cee5885 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -235,6 +235,7 @@ static int p9_fcall_init(struct p9_client *c, struct p9_fcall *fc,
if (!fc->sdata)
return -ENOMEM;
fc->capacity = alloc_msize;
+ fc->tag = 0;
return 0;
}
^ permalink raw reply related [flat|nested] 10+ messages in thread