public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
[parent not found: <90aa64af-52f4-4320-b52e-29370be8c3c8@I-love.SAKURA.ne.jp>]
[parent not found: <2eccab0b-c251-4094-8f2b-2bc9ac3def8e@I-love.SAKURA.ne.jp>]
[parent not found: <554675d7-afc8-445f-94b1-8bba0a774dc3@I-love.SAKURA.ne.jp>]
* Re: [syzbot] [virtualization?] KMSAN: uninit-value in virtqueue_add (4)
@ 2024-02-25  0:27 Edward Adam Davis
  2024-02-25  0:52 ` [syzbot] [mm] " syzbot
  0 siblings, 1 reply; 12+ messages in thread
From: Edward Adam Davis @ 2024-02-25  0:27 UTC (permalink / raw)
  To: syzbot+d7521c1e3841ed075a42; +Cc: linux-kernel, syzkaller-bugs

please test uninit-value in virtqueue_add (4)

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git v6.7

diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
index 9d1bdcdc1331..4ca6627a7459 100644
--- a/drivers/scsi/virtio_scsi.c
+++ b/drivers/scsi/virtio_scsi.c
@@ -427,7 +427,7 @@ static int __virtscsi_add_cmd(struct virtqueue *vq,
 			    size_t req_size, size_t resp_size)
 {
 	struct scsi_cmnd *sc = cmd->sc;
-	struct scatterlist *sgs[6], req, resp;
+	struct scatterlist *sgs[6], req = {}, resp = {};
 	struct sg_table *out, *in;
 	unsigned out_num = 0, in_num = 0;
 


^ permalink raw reply related	[flat|nested] 12+ messages in thread
* Re: [syzbot] [virtualization?] KMSAN: uninit-value in virtqueue_add (4)
  2024-02-24 14:03 [syzbot] [virtualization?] " Tetsuo Handa
@ 2024-02-25  0:01 Tetsuo Handa
  2024-02-25  0:21 ` [syzbot] [mm] " syzbot
  0 siblings, 1 reply; 12+ messages in thread
From: Tetsuo Handa @ 2024-02-25  0:01 UTC (permalink / raw)
  To: syzbot, syzkaller-bugs; +Cc: linux-kernel

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git v6.7

diff --git a/arch/x86/include/asm/page_64.h b/arch/x86/include/asm/page_64.h
index cc6b8e087192..f13bba3a9dab 100644
--- a/arch/x86/include/asm/page_64.h
+++ b/arch/x86/include/asm/page_64.h
@@ -58,7 +58,16 @@ static inline void clear_page(void *page)
 			   : "cc", "memory", "rax", "rcx");
 }
 
+#ifdef CONFIG_KMSAN
+/* Use of non-instrumented assembly version confuses KMSAN. */
+void *memcpy(void *to, const void *from, __kernel_size_t len);
+static inline void copy_page(void *to, void *from)
+{
+	memcpy(to, from, PAGE_SIZE);
+}
+#else
 void copy_page(void *to, void *from);
+#endif
 
 #ifdef CONFIG_X86_5LEVEL
 /*
diff --git a/mm/kmsan/hooks.c b/mm/kmsan/hooks.c
index 5d6e2dee5692..0b09daa188ef 100644
--- a/mm/kmsan/hooks.c
+++ b/mm/kmsan/hooks.c
@@ -359,6 +359,12 @@ void kmsan_handle_dma_sg(struct scatterlist *sg, int nents,
 }
 
 /* Functions from kmsan-checks.h follow. */
+
+/*
+ * To create an origin, kmsan_poison_memory() unwinds the stacks and stores it
+ * into the stack depot. This may cause deadlocks if done from within KMSAN
+ * runtime, therefore we bail out if kmsan_in_runtime().
+ */
 void kmsan_poison_memory(const void *address, size_t size, gfp_t flags)
 {
 	if (!kmsan_enabled || kmsan_in_runtime())
@@ -371,47 +377,31 @@ void kmsan_poison_memory(const void *address, size_t size, gfp_t flags)
 }
 EXPORT_SYMBOL(kmsan_poison_memory);
 
+/*
+ * Unlike kmsan_poison_memory(), this function can be used from within KMSAN
+ * runtime, because it does not trigger allocations or call instrumented code.
+ */
 void kmsan_unpoison_memory(const void *address, size_t size)
 {
 	unsigned long ua_flags;
 
-	if (!kmsan_enabled || kmsan_in_runtime())
+	if (!kmsan_enabled)
 		return;
 
 	ua_flags = user_access_save();
-	kmsan_enter_runtime();
 	/* The users may want to poison/unpoison random memory. */
 	kmsan_internal_unpoison_memory((void *)address, size,
 				       KMSAN_POISON_NOCHECK);
-	kmsan_leave_runtime();
 	user_access_restore(ua_flags);
 }
 EXPORT_SYMBOL(kmsan_unpoison_memory);
 
 /*
- * Version of kmsan_unpoison_memory() that can be called from within the KMSAN
- * runtime.
- *
- * Non-instrumented IRQ entry functions receive struct pt_regs from assembly
- * code. Those regs need to be unpoisoned, otherwise using them will result in
- * false positives.
- * Using kmsan_unpoison_memory() is not an option in entry code, because the
- * return value of in_task() is inconsistent - as a result, certain calls to
- * kmsan_unpoison_memory() are ignored. kmsan_unpoison_entry_regs() ensures that
- * the registers are unpoisoned even if kmsan_in_runtime() is true in the early
- * entry code.
+ * Version of kmsan_unpoison_memory() called from IRQ entry functions.
  */
 void kmsan_unpoison_entry_regs(const struct pt_regs *regs)
 {
-	unsigned long ua_flags;
-
-	if (!kmsan_enabled)
-		return;
-
-	ua_flags = user_access_save();
-	kmsan_internal_unpoison_memory((void *)regs, sizeof(*regs),
-				       KMSAN_POISON_NOCHECK);
-	user_access_restore(ua_flags);
+	kmsan_unpoison_memory((void *)regs, sizeof(*regs));
 }
 
 void kmsan_check_memory(const void *addr, size_t size)



^ permalink raw reply related	[flat|nested] 12+ messages in thread
* Re: [syzbot] [virtualization?] KMSAN: uninit-value in virtqueue_add (4)
  2024-02-24 10:47 [syzbot] [virtualization?] " Tetsuo Handa
@ 2024-02-24 14:03 Tetsuo Handa
  2024-02-24 14:24 ` [syzbot] [mm] " syzbot
  0 siblings, 1 reply; 12+ messages in thread
From: Tetsuo Handa @ 2024-02-24 14:03 UTC (permalink / raw)
  To: syzbot, syzkaller-bugs; +Cc: linux-kernel

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git v6.7

diff --git a/arch/x86/include/asm/page_64.h b/arch/x86/include/asm/page_64.h
index cc6b8e087192..f13bba3a9dab 100644
--- a/arch/x86/include/asm/page_64.h
+++ b/arch/x86/include/asm/page_64.h
@@ -58,7 +58,16 @@ static inline void clear_page(void *page)
 			   : "cc", "memory", "rax", "rcx");
 }
 
+#ifdef CONFIG_KMSAN
+/* Use of non-instrumented assembly version confuses KMSAN. */
+void *memcpy(void *to, const void *from, __kernel_size_t len);
+static inline void copy_page(void *to, void *from)
+{
+	memcpy(to, from, PAGE_SIZE);
+}
+#else
 void copy_page(void *to, void *from);
+#endif
 
 #ifdef CONFIG_X86_5LEVEL
 /*
-- 
2.34.1


^ permalink raw reply related	[flat|nested] 12+ messages in thread
* Re: [syzbot] [virtualization?] KMSAN: uninit-value in virtqueue_add (4)
  2024-02-24  5:53 [syzbot] [virtualization?] " Tetsuo Handa
@ 2024-02-24 10:47 Tetsuo Handa
  2024-02-24 11:19 ` [syzbot] [mm] " syzbot
  0 siblings, 1 reply; 12+ messages in thread
From: Tetsuo Handa @ 2024-02-24 10:47 UTC (permalink / raw)
  To: syzbot, syzkaller-bugs; +Cc: linux-kernel

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

diff --git a/arch/x86/include/asm/page_64.h b/arch/x86/include/asm/page_64.h
index cc6b8e087192..f13bba3a9dab 100644
--- a/arch/x86/include/asm/page_64.h
+++ b/arch/x86/include/asm/page_64.h
@@ -58,7 +58,16 @@ static inline void clear_page(void *page)
 			   : "cc", "memory", "rax", "rcx");
 }
 
+#ifdef CONFIG_KMSAN
+/* Use of non-instrumented assembly version confuses KMSAN. */
+void *memcpy(void *to, const void *from, __kernel_size_t len);
+static inline void copy_page(void *to, void *from)
+{
+	memcpy(to, from, PAGE_SIZE);
+}
+#else
 void copy_page(void *to, void *from);
+#endif
 
 #ifdef CONFIG_X86_5LEVEL
 /*
diff --git a/lib/stackdepot.c b/lib/stackdepot.c
index 5caa1f566553..48277029c282 100644
--- a/lib/stackdepot.c
+++ b/lib/stackdepot.c
@@ -592,22 +592,27 @@ static inline struct stack_record *find_stack(struct list_head *bucket,
 
 		/*
 		 * This may race with depot_free_stack() accessing the freelist
-		 * management state unioned with @entries. The refcount is zero
-		 * in that case and the below refcount_inc_not_zero() will fail.
+		 * management state unioned with @entries.
 		 */
 		if (data_race(stackdepot_memcmp(entries, stack->entries, size)))
 			continue;
 
 		/*
-		 * Try to increment refcount. If this succeeds, the stack record
-		 * is valid and has not yet been freed.
+		 * Check if an invalid record had the same {hash, size, entries}
+		 * by testing whether the refcount is already 0.
+		 * Also, try to increment refcount if STACK_DEPOT_FLAG_GET is used.
 		 *
 		 * If STACK_DEPOT_FLAG_GET is not used, it is undefined behavior
 		 * to then call stack_depot_put() later, and we can assume that
 		 * a stack record is never placed back on the freelist.
 		 */
-		if ((flags & STACK_DEPOT_FLAG_GET) && !refcount_inc_not_zero(&stack->count))
-			continue;
+		if (flags & STACK_DEPOT_FLAG_GET) {
+			if (!refcount_inc_not_zero(&stack->count))
+				continue;
+		} else {
+			if (!refcount_read(&stack->count))
+				continue;
+		}
 
 		ret = stack;
 		break;



^ permalink raw reply related	[flat|nested] 12+ messages in thread
* Re: [syzbot] [virtualization?] KMSAN: uninit-value in virtqueue_add (4)
@ 2024-02-24  5:53 Tetsuo Handa
  2024-02-24  6:22 ` [syzbot] [mm] " syzbot
  0 siblings, 1 reply; 12+ messages in thread
From: Tetsuo Handa @ 2024-02-24  5:53 UTC (permalink / raw)
  To: syzbot, syzkaller-bugs; +Cc: linux-kernel

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

diff --git a/arch/x86/include/asm/page_64.h b/arch/x86/include/asm/page_64.h
index cc6b8e087192..f13bba3a9dab 100644
--- a/arch/x86/include/asm/page_64.h
+++ b/arch/x86/include/asm/page_64.h
@@ -58,7 +58,16 @@ static inline void clear_page(void *page)
 			   : "cc", "memory", "rax", "rcx");
 }
 
+#ifdef CONFIG_KMSAN
+/* Use of non-instrumented assembly version confuses KMSAN. */
+void *memcpy(void *to, const void *from, __kernel_size_t len);
+static inline void copy_page(void *to, void *from)
+{
+	memcpy(to, from, PAGE_SIZE);
+}
+#else
 void copy_page(void *to, void *from);
+#endif
 
 #ifdef CONFIG_X86_5LEVEL
 /*
-- 
2.34.1


^ permalink raw reply related	[flat|nested] 12+ messages in thread
* Re: [syzbot] [virtualization?] KMSAN: uninit-value in virtqueue_add (4)
@ 2024-01-26  6:57 Edward Adam Davis
  2024-01-26  7:34 ` [syzbot] [mm] " syzbot
  0 siblings, 1 reply; 12+ messages in thread
From: Edward Adam Davis @ 2024-01-26  6:57 UTC (permalink / raw)
  To: syzbot+d7521c1e3841ed075a42; +Cc: linux-kernel, syzkaller-bugs

please test uninit-value in virtqueue_add (4)

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
index 9d1bdcdc1331..4ca6627a7459 100644
--- a/drivers/scsi/virtio_scsi.c
+++ b/drivers/scsi/virtio_scsi.c
@@ -427,7 +427,7 @@ static int __virtscsi_add_cmd(struct virtqueue *vq,
 			    size_t req_size, size_t resp_size)
 {
 	struct scsi_cmnd *sc = cmd->sc;
-	struct scatterlist *sgs[6], req, resp;
+	struct scatterlist *sgs[6], req = {}, resp = {};
 	struct sg_table *out, *in;
 	unsigned out_num = 0, in_num = 0;
 


^ permalink raw reply related	[flat|nested] 12+ messages in thread
* Re: [syzbot] [virtualization?] KMSAN: uninit-value in virtqueue_add (4)
@ 2024-01-26  1:35 Edward Adam Davis
  2024-01-26  1:43 ` [syzbot] [mm] " syzbot
  0 siblings, 1 reply; 12+ messages in thread
From: Edward Adam Davis @ 2024-01-26  1:35 UTC (permalink / raw)
  To: syzbot+d7521c1e3841ed075a42; +Cc: linux-kernel, syzkaller-bugs

please test uninit-value in virtqueue_add (4)

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git fbafc3e621c3

diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
index 9d1bdcdc1331..4ca6627a7459 100644
--- a/drivers/scsi/virtio_scsi.c
+++ b/drivers/scsi/virtio_scsi.c
@@ -427,7 +427,7 @@ static int __virtscsi_add_cmd(struct virtqueue *vq,
 			    size_t req_size, size_t resp_size)
 {
 	struct scsi_cmnd *sc = cmd->sc;
-	struct scatterlist *sgs[6], req, resp;
+	struct scatterlist *sgs[6], req = {}, resp = {};
 	struct sg_table *out, *in;
 	unsigned out_num = 0, in_num = 0;
 


^ permalink raw reply related	[flat|nested] 12+ messages in thread
* Re: [syzbot] [virtualization?] KMSAN: uninit-value in virtqueue_add (4)
@ 2024-01-26  0:43 Edward Adam Davis
  2024-01-26  1:26 ` [syzbot] [mm] " syzbot
  0 siblings, 1 reply; 12+ messages in thread
From: Edward Adam Davis @ 2024-01-26  0:43 UTC (permalink / raw)
  To: syzbot+d7521c1e3841ed075a42; +Cc: linux-kernel, syzkaller-bugs

please test uninit-value in virtqueue_add (4)

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
index 9d1bdcdc1331..4ca6627a7459 100644
--- a/drivers/scsi/virtio_scsi.c
+++ b/drivers/scsi/virtio_scsi.c
@@ -427,7 +427,7 @@ static int __virtscsi_add_cmd(struct virtqueue *vq,
 			    size_t req_size, size_t resp_size)
 {
 	struct scsi_cmnd *sc = cmd->sc;
-	struct scatterlist *sgs[6], req, resp;
+	struct scatterlist *sgs[6], req = {}, resp = {};
 	struct sg_table *out, *in;
 	unsigned out_num = 0, in_num = 0;
 


^ permalink raw reply related	[flat|nested] 12+ messages in thread
end of thread, other threads:[~2024-03-06 14:38 UTC | newest]

Thread overview: 12+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
     [not found] <f555e0b7-00f6-48e2-abe5-b29bedf8c4c3@I-love.SAKURA.ne.jp>
2024-02-25  2:19 ` [syzbot] [mm] KMSAN: uninit-value in virtqueue_add (4) syzbot
     [not found] <90aa64af-52f4-4320-b52e-29370be8c3c8@I-love.SAKURA.ne.jp>
2024-03-06 14:38 ` syzbot
     [not found] <2eccab0b-c251-4094-8f2b-2bc9ac3def8e@I-love.SAKURA.ne.jp>
2024-02-25  4:33 ` syzbot
     [not found] <554675d7-afc8-445f-94b1-8bba0a774dc3@I-love.SAKURA.ne.jp>
2024-02-25  3:12 ` syzbot
2024-02-25  0:27 [syzbot] [virtualization?] " Edward Adam Davis
2024-02-25  0:52 ` [syzbot] [mm] " syzbot
  -- strict thread matches above, loose matches on Subject: below --
2024-02-25  0:01 [syzbot] [virtualization?] " Tetsuo Handa
2024-02-25  0:21 ` [syzbot] [mm] " syzbot
2024-02-24 14:03 [syzbot] [virtualization?] " Tetsuo Handa
2024-02-24 14:24 ` [syzbot] [mm] " syzbot
2024-02-24 10:47 [syzbot] [virtualization?] " Tetsuo Handa
2024-02-24 11:19 ` [syzbot] [mm] " syzbot
2024-02-24  5:53 [syzbot] [virtualization?] " Tetsuo Handa
2024-02-24  6:22 ` [syzbot] [mm] " syzbot
2024-01-26  6:57 [syzbot] [virtualization?] " Edward Adam Davis
2024-01-26  7:34 ` [syzbot] [mm] " syzbot
2024-01-26  1:35 [syzbot] [virtualization?] " Edward Adam Davis
2024-01-26  1:43 ` [syzbot] [mm] " syzbot
2024-01-26  0:43 [syzbot] [virtualization?] " Edward Adam Davis
2024-01-26  1:26 ` [syzbot] [mm] " syzbot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox