* [syzbot] [kernel?] KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl (3)
@ 2025-06-19 23:57 syzbot
2025-06-22 2:37 ` Edward Adam Davis
` (3 more replies)
0 siblings, 4 replies; 23+ messages in thread
From: syzbot @ 2025-06-19 23:57 UTC (permalink / raw)
To: arnd, bcm-kernel-feedback-list, bryan-bt.tan, gregkh,
linux-kernel, syzkaller-bugs, vishnu.dasa
Hello,
syzbot found the following issue on:
HEAD commit: 08215f5486ec Merge tag 'kbuild-fixes-v6.16' of git://git.k..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=13f7fd70580000
kernel config: https://syzkaller.appspot.com/x/.config?x=61539536677af51c
dashboard link: https://syzkaller.appspot.com/bug?extid=9b9124ae9b12d5af5d95
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17f7fd70580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1485690c580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/01c395d764eb/disk-08215f54.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/15fc58e6441d/vmlinux-08215f54.xz
kernel image: https://storage.googleapis.com/syzbot-assets/dbd5ac78ef83/bzImage-08215f54.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9b9124ae9b12d5af5d95@syzkaller.appspotmail.com
=====================================================
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
BUG: KMSAN: kernel-infoleak in _inline_copy_to_user include/linux/uaccess.h:196 [inline]
BUG: KMSAN: kernel-infoleak in _copy_to_user+0xcc/0x120 lib/usercopy.c:26
instrument_copy_to_user include/linux/instrumented.h:114 [inline]
_inline_copy_to_user include/linux/uaccess.h:196 [inline]
_copy_to_user+0xcc/0x120 lib/usercopy.c:26
copy_to_user include/linux/uaccess.h:225 [inline]
vmci_host_do_receive_datagram drivers/misc/vmw_vmci/vmci_host.c:438 [inline]
vmci_host_unlocked_ioctl+0x1e7e/0x5200 drivers/misc/vmw_vmci/vmci_host.c:932
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0x23c/0x400 fs/ioctl.c:893
__x64_sys_ioctl+0x97/0xe0 fs/ioctl.c:893
x64_sys_call+0x1ebe/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:17
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Local variable __x.i.i created at:
set_xfeature_in_sigframe arch/x86/kernel/fpu/xstate.h:81 [inline]
save_xstate_epilog arch/x86/kernel/fpu/signal.c:140 [inline]
copy_fpstate_to_sigframe+0x11f2/0x13d0 arch/x86/kernel/fpu/signal.c:232
get_sigframe+0xc6a/0x1020 arch/x86/kernel/signal.c:163
Bytes 28-31 of 40 are uninitialized
Memory access of size 40 starts at ffff888131f74080
Data copied to user address 000000000000a4bf
CPU: 1 UID: 0 PID: 5798 Comm: syz-executor419 Not tainted 6.16.0-rc1-syzkaller-00239-g08215f5486ec #0 PREEMPT(undef)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
=====================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 23+ messages in thread
* Re: [syzbot] [kernel?] KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl (3)
[not found] <20250620010300.3380487-1-lizhi.xu@windriver.com>
@ 2025-06-20 2:55 ` syzbot
0 siblings, 0 replies; 23+ messages in thread
From: syzbot @ 2025-06-20 2:55 UTC (permalink / raw)
To: linux-kernel, lizhi.xu, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl
=====================================================
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
BUG: KMSAN: kernel-infoleak in _inline_copy_to_user include/linux/uaccess.h:196 [inline]
BUG: KMSAN: kernel-infoleak in _copy_to_user+0xcc/0x120 lib/usercopy.c:26
instrument_copy_to_user include/linux/instrumented.h:114 [inline]
_inline_copy_to_user include/linux/uaccess.h:196 [inline]
_copy_to_user+0xcc/0x120 lib/usercopy.c:26
copy_to_user include/linux/uaccess.h:225 [inline]
vmci_host_do_receive_datagram drivers/misc/vmw_vmci/vmci_host.c:438 [inline]
vmci_host_unlocked_ioctl+0x1e7e/0x5200 drivers/misc/vmw_vmci/vmci_host.c:932
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0x23c/0x400 fs/ioctl.c:893
__x64_sys_ioctl+0x97/0xe0 fs/ioctl.c:893
x64_sys_call+0x1ebe/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:17
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was stored to memory at:
kmemdup_noprof+0xb0/0x100 mm/util.c:139
kmemdup_noprof include/linux/fortify-string.h:765 [inline]
dg_dispatch_as_host drivers/misc/vmw_vmci/vmci_datagram.c:272 [inline]
vmci_datagram_dispatch+0x4eb/0x1560 drivers/misc/vmw_vmci/vmci_datagram.c:340
ctx_fire_notification drivers/misc/vmw_vmci/vmci_context.c:257 [inline]
ctx_free_ctx drivers/misc/vmw_vmci/vmci_context.c:435 [inline]
kref_put include/linux/kref.h:65 [inline]
vmci_ctx_put+0x88e/0x15d0 drivers/misc/vmw_vmci/vmci_context.c:497
vmci_ctx_destroy+0x15d/0x250 drivers/misc/vmw_vmci/vmci_context.c:195
vmci_host_do_init_context drivers/misc/vmw_vmci/vmci_host.c:341 [inline]
vmci_host_unlocked_ioctl+0x4592/0x5200 drivers/misc/vmw_vmci/vmci_host.c:928
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0x23c/0x400 fs/ioctl.c:893
__x64_sys_ioctl+0x97/0xe0 fs/ioctl.c:893
x64_sys_call+0x1ebe/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:17
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Local variable ev.i.i created at:
ctx_fire_notification drivers/misc/vmw_vmci/vmci_context.c:248 [inline]
ctx_free_ctx drivers/misc/vmw_vmci/vmci_context.c:435 [inline]
kref_put include/linux/kref.h:65 [inline]
vmci_ctx_put+0x76b/0x15d0 drivers/misc/vmw_vmci/vmci_context.c:497
vmci_ctx_destroy+0x15d/0x250 drivers/misc/vmw_vmci/vmci_context.c:195
Bytes 28-31 of 40 are uninitialized
Memory access of size 40 starts at ffff888116238bc0
Data copied to user address 000000000000a4bf
CPU: 1 UID: 0 PID: 6732 Comm: syz.0.16 Not tainted 6.16.0-rc2-syzkaller-00162-g41687a5c6f8b-dirty #0 PREEMPT(undef)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
=====================================================
Tested on:
commit: 41687a5c Merge tag 'spi-fix-v6.16-rc2' of git://git.ke..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=136a9d0c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=db26f33438d76de9
dashboard link: https://syzkaller.appspot.com/bug?extid=9b9124ae9b12d5af5d95
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
patch: https://syzkaller.appspot.com/x/patch.diff?x=1567dd0c580000
^ permalink raw reply [flat|nested] 23+ messages in thread
* Re: [syzbot] [kernel?] KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl (3)
[not found] <20250620042056.1099990-1-lizhi.xu@windriver.com>
@ 2025-06-20 4:28 ` syzbot
0 siblings, 0 replies; 23+ messages in thread
From: syzbot @ 2025-06-20 4:28 UTC (permalink / raw)
To: linux-kernel, lizhi.xu, syzkaller-bugs
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
drivers/misc/vmw_vmci/vmci_host.c:396:25: error: incompatible integer to pointer conversion passing 'u64' (aka 'unsigned long long') to parameter of type 'const void *' [-Wint-conversion]
Tested on:
commit: 41687a5c Merge tag 'spi-fix-v6.16-rc2' of git://git.ke..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=61539536677af51c
dashboard link: https://syzkaller.appspot.com/bug?extid=9b9124ae9b12d5af5d95
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
patch: https://syzkaller.appspot.com/x/patch.diff?x=14219d0c580000
^ permalink raw reply [flat|nested] 23+ messages in thread
* Re: [syzbot] [kernel?] KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl (3)
[not found] <20250620052310.1280771-1-lizhi.xu@windriver.com>
@ 2025-06-20 5:58 ` syzbot
0 siblings, 0 replies; 23+ messages in thread
From: syzbot @ 2025-06-20 5:58 UTC (permalink / raw)
To: linux-kernel, lizhi.xu, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl
=====================================================
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
BUG: KMSAN: kernel-infoleak in _inline_copy_to_user include/linux/uaccess.h:196 [inline]
BUG: KMSAN: kernel-infoleak in _copy_to_user+0xcc/0x120 lib/usercopy.c:26
instrument_copy_to_user include/linux/instrumented.h:114 [inline]
_inline_copy_to_user include/linux/uaccess.h:196 [inline]
_copy_to_user+0xcc/0x120 lib/usercopy.c:26
copy_to_user include/linux/uaccess.h:225 [inline]
vmci_host_do_receive_datagram drivers/misc/vmw_vmci/vmci_host.c:444 [inline]
vmci_host_unlocked_ioctl+0x1e1d/0x5360 drivers/misc/vmw_vmci/vmci_host.c:938
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0x23c/0x400 fs/ioctl.c:893
__x64_sys_ioctl+0x97/0xe0 fs/ioctl.c:893
x64_sys_call+0x1ebe/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:17
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was stored to memory at:
kmemdup_noprof+0xb0/0x100 mm/util.c:139
kmemdup_noprof include/linux/fortify-string.h:765 [inline]
dg_dispatch_as_host drivers/misc/vmw_vmci/vmci_datagram.c:272 [inline]
vmci_datagram_dispatch+0x4eb/0x1560 drivers/misc/vmw_vmci/vmci_datagram.c:340
ctx_fire_notification drivers/misc/vmw_vmci/vmci_context.c:257 [inline]
ctx_free_ctx drivers/misc/vmw_vmci/vmci_context.c:435 [inline]
kref_put include/linux/kref.h:65 [inline]
vmci_ctx_put+0x88e/0x15d0 drivers/misc/vmw_vmci/vmci_context.c:497
vmci_ctx_destroy+0x15d/0x250 drivers/misc/vmw_vmci/vmci_context.c:195
vmci_host_do_init_context drivers/misc/vmw_vmci/vmci_host.c:341 [inline]
vmci_host_unlocked_ioctl+0x4524/0x5360 drivers/misc/vmw_vmci/vmci_host.c:934
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0x23c/0x400 fs/ioctl.c:893
__x64_sys_ioctl+0x97/0xe0 fs/ioctl.c:893
x64_sys_call+0x1ebe/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:17
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Local variable ev.i.i created at:
ctx_fire_notification drivers/misc/vmw_vmci/vmci_context.c:248 [inline]
ctx_free_ctx drivers/misc/vmw_vmci/vmci_context.c:435 [inline]
kref_put include/linux/kref.h:65 [inline]
vmci_ctx_put+0x76b/0x15d0 drivers/misc/vmw_vmci/vmci_context.c:497
vmci_ctx_destroy+0x15d/0x250 drivers/misc/vmw_vmci/vmci_context.c:195
Bytes 28-31 of 40 are uninitialized
Memory access of size 40 starts at ffff888013ca72c0
Data copied to user address 000000000000a4bf
CPU: 1 UID: 0 PID: 6602 Comm: syz.0.16 Not tainted 6.16.0-rc2-syzkaller-00162-g41687a5c6f8b-dirty #0 PREEMPT(undef)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
=====================================================
Tested on:
commit: 41687a5c Merge tag 'spi-fix-v6.16-rc2' of git://git.ke..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=166d9d0c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=db26f33438d76de9
dashboard link: https://syzkaller.appspot.com/bug?extid=9b9124ae9b12d5af5d95
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
patch: https://syzkaller.appspot.com/x/patch.diff?x=15659d0c580000
^ permalink raw reply [flat|nested] 23+ messages in thread
* Re: [syzbot] [kernel?] KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl (3)
[not found] <20250620065230.1552640-1-lizhi.xu@windriver.com>
@ 2025-06-20 8:49 ` syzbot
0 siblings, 0 replies; 23+ messages in thread
From: syzbot @ 2025-06-20 8:49 UTC (permalink / raw)
To: linux-kernel, lizhi.xu, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl
=====================================================
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
BUG: KMSAN: kernel-infoleak in _inline_copy_to_user include/linux/uaccess.h:196 [inline]
BUG: KMSAN: kernel-infoleak in _copy_to_user+0xcc/0x120 lib/usercopy.c:26
instrument_copy_to_user include/linux/instrumented.h:114 [inline]
_inline_copy_to_user include/linux/uaccess.h:196 [inline]
_copy_to_user+0xcc/0x120 lib/usercopy.c:26
copy_to_user include/linux/uaccess.h:225 [inline]
vmci_host_do_receive_datagram drivers/misc/vmw_vmci/vmci_host.c:439 [inline]
vmci_host_unlocked_ioctl+0x1d05/0x5260 drivers/misc/vmw_vmci/vmci_host.c:933
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0x23c/0x400 fs/ioctl.c:893
__x64_sys_ioctl+0x97/0xe0 fs/ioctl.c:893
x64_sys_call+0x1ebe/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:17
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was stored to memory at:
kmemdup_noprof+0xb0/0x100 mm/util.c:139
kmemdup_noprof include/linux/fortify-string.h:765 [inline]
dg_dispatch_as_host drivers/misc/vmw_vmci/vmci_datagram.c:272 [inline]
vmci_datagram_dispatch+0x4eb/0x1560 drivers/misc/vmw_vmci/vmci_datagram.c:340
ctx_fire_notification drivers/misc/vmw_vmci/vmci_context.c:257 [inline]
ctx_free_ctx drivers/misc/vmw_vmci/vmci_context.c:435 [inline]
kref_put include/linux/kref.h:65 [inline]
vmci_ctx_put+0x88e/0x15d0 drivers/misc/vmw_vmci/vmci_context.c:497
vmci_ctx_destroy+0x15d/0x250 drivers/misc/vmw_vmci/vmci_context.c:195
vmci_host_do_init_context drivers/misc/vmw_vmci/vmci_host.c:341 [inline]
vmci_host_unlocked_ioctl+0x45c1/0x5260 drivers/misc/vmw_vmci/vmci_host.c:929
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0x23c/0x400 fs/ioctl.c:893
__x64_sys_ioctl+0x97/0xe0 fs/ioctl.c:893
x64_sys_call+0x1ebe/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:17
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Local variable ev.i.i created at:
ctx_fire_notification drivers/misc/vmw_vmci/vmci_context.c:248 [inline]
ctx_free_ctx drivers/misc/vmw_vmci/vmci_context.c:435 [inline]
kref_put include/linux/kref.h:65 [inline]
vmci_ctx_put+0x76b/0x15d0 drivers/misc/vmw_vmci/vmci_context.c:497
vmci_ctx_destroy+0x15d/0x250 drivers/misc/vmw_vmci/vmci_context.c:195
Bytes 28-31 of 40 are uninitialized
Memory access of size 40 starts at ffff8880231f26c0
Data copied to user address 000000000000a4bf
CPU: 0 UID: 0 PID: 6787 Comm: syz.0.16 Not tainted 6.16.0-rc2-syzkaller-00231-g75f5f23f8787-dirty #0 PREEMPT(undef)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
=====================================================
Tested on:
commit: 75f5f23f Merge tag 'block-6.16-20250619' of git://git...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14a13d0c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=db26f33438d76de9
dashboard link: https://syzkaller.appspot.com/bug?extid=9b9124ae9b12d5af5d95
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
patch: https://syzkaller.appspot.com/x/patch.diff?x=15f39d0c580000
^ permalink raw reply [flat|nested] 23+ messages in thread
* Re: [syzbot] [kernel?] KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl (3)
[not found] <20250620065432.1558000-1-lizhi.xu@windriver.com>
@ 2025-06-20 10:02 ` syzbot
0 siblings, 0 replies; 23+ messages in thread
From: syzbot @ 2025-06-20 10:02 UTC (permalink / raw)
To: linux-kernel, lizhi.xu, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl
=====================================================
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
BUG: KMSAN: kernel-infoleak in _inline_copy_to_user include/linux/uaccess.h:196 [inline]
BUG: KMSAN: kernel-infoleak in _copy_to_user+0xcc/0x120 lib/usercopy.c:26
instrument_copy_to_user include/linux/instrumented.h:114 [inline]
_inline_copy_to_user include/linux/uaccess.h:196 [inline]
_copy_to_user+0xcc/0x120 lib/usercopy.c:26
copy_to_user include/linux/uaccess.h:225 [inline]
vmci_host_do_receive_datagram drivers/misc/vmw_vmci/vmci_host.c:439 [inline]
vmci_host_unlocked_ioctl+0x1d05/0x5260 drivers/misc/vmw_vmci/vmci_host.c:933
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0x23c/0x400 fs/ioctl.c:893
__x64_sys_ioctl+0x97/0xe0 fs/ioctl.c:893
x64_sys_call+0x1ebe/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:17
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was stored to memory at:
kmemdup_noprof+0xb0/0x100 mm/util.c:139
kmemdup_noprof include/linux/fortify-string.h:765 [inline]
dg_dispatch_as_host drivers/misc/vmw_vmci/vmci_datagram.c:272 [inline]
vmci_datagram_dispatch+0x4eb/0x1560 drivers/misc/vmw_vmci/vmci_datagram.c:340
ctx_fire_notification drivers/misc/vmw_vmci/vmci_context.c:257 [inline]
ctx_free_ctx drivers/misc/vmw_vmci/vmci_context.c:435 [inline]
kref_put include/linux/kref.h:65 [inline]
vmci_ctx_put+0x88e/0x15d0 drivers/misc/vmw_vmci/vmci_context.c:497
vmci_ctx_destroy+0x15d/0x250 drivers/misc/vmw_vmci/vmci_context.c:195
vmci_host_do_init_context drivers/misc/vmw_vmci/vmci_host.c:341 [inline]
vmci_host_unlocked_ioctl+0x45be/0x5260 drivers/misc/vmw_vmci/vmci_host.c:929
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0x23c/0x400 fs/ioctl.c:893
__x64_sys_ioctl+0x97/0xe0 fs/ioctl.c:893
x64_sys_call+0x1ebe/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:17
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Local variable ev.i.i created at:
ctx_fire_notification drivers/misc/vmw_vmci/vmci_context.c:248 [inline]
ctx_free_ctx drivers/misc/vmw_vmci/vmci_context.c:435 [inline]
kref_put include/linux/kref.h:65 [inline]
vmci_ctx_put+0x76b/0x15d0 drivers/misc/vmw_vmci/vmci_context.c:497
vmci_ctx_destroy+0x15d/0x250 drivers/misc/vmw_vmci/vmci_context.c:195
Bytes 28-31 of 40 are uninitialized
Memory access of size 40 starts at ffff888013c866c0
Data copied to user address 000000000000a4bf
CPU: 1 UID: 0 PID: 6832 Comm: syz.0.16 Not tainted 6.16.0-rc2-syzkaller-00231-g75f5f23f8787-dirty #0 PREEMPT(undef)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
=====================================================
Tested on:
commit: 75f5f23f Merge tag 'block-6.16-20250619' of git://git...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=128c5370580000
kernel config: https://syzkaller.appspot.com/x/.config?x=db26f33438d76de9
dashboard link: https://syzkaller.appspot.com/bug?extid=9b9124ae9b12d5af5d95
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
patch: https://syzkaller.appspot.com/x/patch.diff?x=11b88182580000
^ permalink raw reply [flat|nested] 23+ messages in thread
* Re: [syzbot] [kernel?] KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl (3)
2025-06-19 23:57 syzbot
@ 2025-06-22 2:37 ` Edward Adam Davis
2025-06-22 3:02 ` syzbot
2025-06-22 4:46 ` Hillf Danton
` (2 subsequent siblings)
3 siblings, 1 reply; 23+ messages in thread
From: Edward Adam Davis @ 2025-06-22 2:37 UTC (permalink / raw)
To: syzbot+9b9124ae9b12d5af5d95; +Cc: linux-kernel, syzkaller-bugs
#syz test
diff --git a/drivers/misc/vmw_vmci/vmci_host.c b/drivers/misc/vmw_vmci/vmci_host.c
index b64944367ac5..e0d3af8e62b5 100644
--- a/drivers/misc/vmw_vmci/vmci_host.c
+++ b/drivers/misc/vmw_vmci/vmci_host.c
@@ -434,6 +434,7 @@ static int vmci_host_do_receive_datagram(struct vmci_host_dev *vmci_host_dev,
&size, &dg);
if (recv_info.result >= VMCI_SUCCESS) {
+ memset((char*)dg + 27, 0, 4);
void __user *ubuf = (void __user *)(uintptr_t)recv_info.addr;
retval = copy_to_user(ubuf, dg, VMCI_DG_SIZE(dg));
kfree(dg);
^ permalink raw reply related [flat|nested] 23+ messages in thread
* Re: [syzbot] [kernel?] KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl (3)
2025-06-22 2:37 ` Edward Adam Davis
@ 2025-06-22 3:02 ` syzbot
0 siblings, 0 replies; 23+ messages in thread
From: syzbot @ 2025-06-22 3:02 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl
=====================================================
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
BUG: KMSAN: kernel-infoleak in _inline_copy_to_user include/linux/uaccess.h:196 [inline]
BUG: KMSAN: kernel-infoleak in _copy_to_user+0xcc/0x120 lib/usercopy.c:26
instrument_copy_to_user include/linux/instrumented.h:114 [inline]
_inline_copy_to_user include/linux/uaccess.h:196 [inline]
_copy_to_user+0xcc/0x120 lib/usercopy.c:26
copy_to_user include/linux/uaccess.h:225 [inline]
vmci_host_do_receive_datagram drivers/misc/vmw_vmci/vmci_host.c:439 [inline]
vmci_host_unlocked_ioctl+0x1ead/0x5240 drivers/misc/vmw_vmci/vmci_host.c:933
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0x239/0x400 fs/ioctl.c:893
__x64_sys_ioctl+0x97/0xe0 fs/ioctl.c:893
x64_sys_call+0x1ebe/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:17
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was stored to memory at:
kmemdup_noprof+0xb0/0x100 mm/util.c:139
kmemdup_noprof include/linux/fortify-string.h:765 [inline]
dg_dispatch_as_host drivers/misc/vmw_vmci/vmci_datagram.c:272 [inline]
vmci_datagram_dispatch+0x4eb/0x1560 drivers/misc/vmw_vmci/vmci_datagram.c:340
ctx_fire_notification drivers/misc/vmw_vmci/vmci_context.c:257 [inline]
ctx_free_ctx drivers/misc/vmw_vmci/vmci_context.c:435 [inline]
kref_put include/linux/kref.h:65 [inline]
vmci_ctx_put+0x88e/0x15d0 drivers/misc/vmw_vmci/vmci_context.c:497
vmci_ctx_destroy+0x15d/0x250 drivers/misc/vmw_vmci/vmci_context.c:195
vmci_host_do_init_context drivers/misc/vmw_vmci/vmci_host.c:341 [inline]
vmci_host_unlocked_ioctl+0x45cd/0x5240 drivers/misc/vmw_vmci/vmci_host.c:929
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0x239/0x400 fs/ioctl.c:893
__x64_sys_ioctl+0x97/0xe0 fs/ioctl.c:893
x64_sys_call+0x1ebe/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:17
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Local variable ev.i.i created at:
ctx_fire_notification drivers/misc/vmw_vmci/vmci_context.c:248 [inline]
ctx_free_ctx drivers/misc/vmw_vmci/vmci_context.c:435 [inline]
kref_put include/linux/kref.h:65 [inline]
vmci_ctx_put+0x76b/0x15d0 drivers/misc/vmw_vmci/vmci_context.c:497
vmci_ctx_destroy+0x15d/0x250 drivers/misc/vmw_vmci/vmci_context.c:195
Byte 31 of 40 is uninitialized
Memory access of size 40 starts at ffff8880219a0880
Data copied to user address 000000000000a4bf
CPU: 0 UID: 0 PID: 6814 Comm: syz.0.16 Not tainted 6.16.0-rc2-syzkaller-00318-g739a6c93cc75-dirty #0 PREEMPT(undef)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
=====================================================
Tested on:
commit: 739a6c93 Merge tag 'nfsd-6.16-1' of git://git.kernel.o..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12580ebc580000
kernel config: https://syzkaller.appspot.com/x/.config?x=db26f33438d76de9
dashboard link: https://syzkaller.appspot.com/bug?extid=9b9124ae9b12d5af5d95
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
patch: https://syzkaller.appspot.com/x/patch.diff?x=16fdf30c580000
^ permalink raw reply [flat|nested] 23+ messages in thread
* Re: [syzbot] [kernel?] KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl (3)
2025-06-19 23:57 syzbot
2025-06-22 2:37 ` Edward Adam Davis
@ 2025-06-22 4:46 ` Hillf Danton
2025-06-22 5:19 ` syzbot
2025-06-22 6:28 ` Hillf Danton
2025-06-23 12:29 ` Edward Adam Davis
3 siblings, 1 reply; 23+ messages in thread
From: Hillf Danton @ 2025-06-22 4:46 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
On Thu, 19 Jun 2025 16:57:26 -0700
> syzbot found the following issue on:
>
> HEAD commit: 08215f5486ec Merge tag 'kbuild-fixes-v6.16' of git://git.k..
> git tree: upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=13f7fd70580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=61539536677af51c
> dashboard link: https://syzkaller.appspot.com/bug?extid=9b9124ae9b12d5af5d95
> compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17f7fd70580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1485690c580000
#syz test
--- x/drivers/misc/vmw_vmci/vmci_context.c
+++ y/drivers/misc/vmw_vmci/vmci_context.c
@@ -535,6 +535,7 @@ int vmci_ctx_dequeue_datagram(struct vmc
(u32) *max_size);
return VMCI_ERROR_NO_MEM;
}
+ *max_size = dq_entry->dg_size;
list_del(list_item);
context->pending_datagrams--;
--- x/drivers/misc/vmw_vmci/vmci_host.c
+++ y/drivers/misc/vmw_vmci/vmci_host.c
@@ -435,7 +435,7 @@ static int vmci_host_do_receive_datagram
if (recv_info.result >= VMCI_SUCCESS) {
void __user *ubuf = (void __user *)(uintptr_t)recv_info.addr;
- retval = copy_to_user(ubuf, dg, VMCI_DG_SIZE(dg));
+ retval = copy_to_user(ubuf, dg, size);
kfree(dg);
if (retval != 0)
return -EFAULT;
--
^ permalink raw reply [flat|nested] 23+ messages in thread
* Re: [syzbot] [kernel?] KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl (3)
2025-06-22 4:46 ` Hillf Danton
@ 2025-06-22 5:19 ` syzbot
0 siblings, 0 replies; 23+ messages in thread
From: syzbot @ 2025-06-22 5:19 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl
=====================================================
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
BUG: KMSAN: kernel-infoleak in _inline_copy_to_user include/linux/uaccess.h:196 [inline]
BUG: KMSAN: kernel-infoleak in _copy_to_user+0xcc/0x120 lib/usercopy.c:26
instrument_copy_to_user include/linux/instrumented.h:114 [inline]
_inline_copy_to_user include/linux/uaccess.h:196 [inline]
_copy_to_user+0xcc/0x120 lib/usercopy.c:26
copy_to_user include/linux/uaccess.h:225 [inline]
vmci_host_do_receive_datagram drivers/misc/vmw_vmci/vmci_host.c:438 [inline]
vmci_host_unlocked_ioctl+0x1e74/0x51f0 drivers/misc/vmw_vmci/vmci_host.c:932
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0x239/0x400 fs/ioctl.c:893
__x64_sys_ioctl+0x97/0xe0 fs/ioctl.c:893
x64_sys_call+0x1ebe/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:17
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was stored to memory at:
kmemdup_noprof+0xb0/0x100 mm/util.c:139
kmemdup_noprof include/linux/fortify-string.h:765 [inline]
dg_dispatch_as_host drivers/misc/vmw_vmci/vmci_datagram.c:272 [inline]
vmci_datagram_dispatch+0x4eb/0x1560 drivers/misc/vmw_vmci/vmci_datagram.c:340
ctx_fire_notification drivers/misc/vmw_vmci/vmci_context.c:257 [inline]
ctx_free_ctx drivers/misc/vmw_vmci/vmci_context.c:435 [inline]
kref_put include/linux/kref.h:65 [inline]
vmci_ctx_put+0x88e/0x15d0 drivers/misc/vmw_vmci/vmci_context.c:497
vmci_ctx_destroy+0x15d/0x250 drivers/misc/vmw_vmci/vmci_context.c:195
vmci_host_do_init_context drivers/misc/vmw_vmci/vmci_host.c:341 [inline]
vmci_host_unlocked_ioctl+0x4579/0x51f0 drivers/misc/vmw_vmci/vmci_host.c:928
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0x239/0x400 fs/ioctl.c:893
__x64_sys_ioctl+0x97/0xe0 fs/ioctl.c:893
x64_sys_call+0x1ebe/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:17
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Local variable ev.i.i created at:
ctx_fire_notification drivers/misc/vmw_vmci/vmci_context.c:248 [inline]
ctx_free_ctx drivers/misc/vmw_vmci/vmci_context.c:435 [inline]
kref_put include/linux/kref.h:65 [inline]
vmci_ctx_put+0x76b/0x15d0 drivers/misc/vmw_vmci/vmci_context.c:497
vmci_ctx_destroy+0x15d/0x250 drivers/misc/vmw_vmci/vmci_context.c:195
Bytes 28-31 of 40 are uninitialized
Memory access of size 40 starts at ffff8880470d5780
Data copied to user address 000000000000a4bf
CPU: 1 UID: 0 PID: 6789 Comm: syz.0.16 Not tainted 6.16.0-rc2-syzkaller-00318-g739a6c93cc75-dirty #0 PREEMPT(undef)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
=====================================================
Tested on:
commit: 739a6c93 Merge tag 'nfsd-6.16-1' of git://git.kernel.o..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1392b30c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=db26f33438d76de9
dashboard link: https://syzkaller.appspot.com/bug?extid=9b9124ae9b12d5af5d95
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
patch: https://syzkaller.appspot.com/x/patch.diff?x=167c2182580000
^ permalink raw reply [flat|nested] 23+ messages in thread
* Re: [syzbot] [kernel?] KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl (3)
2025-06-19 23:57 syzbot
2025-06-22 2:37 ` Edward Adam Davis
2025-06-22 4:46 ` Hillf Danton
@ 2025-06-22 6:28 ` Hillf Danton
2025-06-22 7:32 ` syzbot
2025-06-23 12:29 ` Edward Adam Davis
3 siblings, 1 reply; 23+ messages in thread
From: Hillf Danton @ 2025-06-22 6:28 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
On Thu, 19 Jun 2025 16:57:26 -0700
> syzbot found the following issue on:
>
> HEAD commit: 08215f5486ec Merge tag 'kbuild-fixes-v6.16' of git://git.k..
> git tree: upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=13f7fd70580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=61539536677af51c
> dashboard link: https://syzkaller.appspot.com/bug?extid=9b9124ae9b12d5af5d95
> compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17f7fd70580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1485690c580000
#syz test
--- x/drivers/misc/vmw_vmci/vmci_context.c
+++ y/drivers/misc/vmw_vmci/vmci_context.c
@@ -245,7 +245,7 @@ static int ctx_fire_notification(u32 con
array_size = vmci_handle_arr_get_size(subscriber_array);
for (i = 0; i < array_size; i++) {
int result;
- struct vmci_event_ctx ev;
+ struct vmci_event_ctx ev = {0};
ev.msg.hdr.dst = vmci_handle_arr_get_entry(subscriber_array, i);
ev.msg.hdr.src = vmci_make_handle(VMCI_HYPERVISOR_CONTEXT_ID,
--
^ permalink raw reply [flat|nested] 23+ messages in thread
* Re: [syzbot] [kernel?] KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl (3)
2025-06-22 6:28 ` Hillf Danton
@ 2025-06-22 7:32 ` syzbot
0 siblings, 0 replies; 23+ messages in thread
From: syzbot @ 2025-06-22 7:32 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+9b9124ae9b12d5af5d95@syzkaller.appspotmail.com
Tested-by: syzbot+9b9124ae9b12d5af5d95@syzkaller.appspotmail.com
Tested on:
commit: 739a6c93 Merge tag 'nfsd-6.16-1' of git://git.kernel.o..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=10762182580000
kernel config: https://syzkaller.appspot.com/x/.config?x=db26f33438d76de9
dashboard link: https://syzkaller.appspot.com/bug?extid=9b9124ae9b12d5af5d95
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
patch: https://syzkaller.appspot.com/x/patch.diff?x=1756b30c580000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 23+ messages in thread
* Re: [syzbot] [kernel?] KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl (3)
[not found] <20250623030312.2337101-1-lizhi.xu@windriver.com>
@ 2025-06-23 4:28 ` syzbot
0 siblings, 0 replies; 23+ messages in thread
From: syzbot @ 2025-06-23 4:28 UTC (permalink / raw)
To: linux-kernel, lizhi.xu, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl
=====================================================
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
BUG: KMSAN: kernel-infoleak in _inline_copy_to_user include/linux/uaccess.h:196 [inline]
BUG: KMSAN: kernel-infoleak in _copy_to_user+0xcc/0x120 lib/usercopy.c:26
instrument_copy_to_user include/linux/instrumented.h:114 [inline]
_inline_copy_to_user include/linux/uaccess.h:196 [inline]
_copy_to_user+0xcc/0x120 lib/usercopy.c:26
copy_to_user include/linux/uaccess.h:225 [inline]
vmci_host_do_receive_datagram drivers/misc/vmw_vmci/vmci_host.c:441 [inline]
vmci_host_unlocked_ioctl+0x3d49/0x5340 drivers/misc/vmw_vmci/vmci_host.c:935
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0x239/0x400 fs/ioctl.c:893
__x64_sys_ioctl+0x97/0xe0 fs/ioctl.c:893
x64_sys_call+0x1ebe/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:17
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was stored to memory at:
kmemdup_noprof+0xb0/0x100 mm/util.c:139
kmemdup_noprof include/linux/fortify-string.h:765 [inline]
dg_dispatch_as_host drivers/misc/vmw_vmci/vmci_datagram.c:272 [inline]
vmci_datagram_dispatch+0x4eb/0x1560 drivers/misc/vmw_vmci/vmci_datagram.c:340
ctx_fire_notification drivers/misc/vmw_vmci/vmci_context.c:257 [inline]
ctx_free_ctx drivers/misc/vmw_vmci/vmci_context.c:435 [inline]
kref_put include/linux/kref.h:65 [inline]
vmci_ctx_put+0x88e/0x15d0 drivers/misc/vmw_vmci/vmci_context.c:497
vmci_ctx_destroy+0x15d/0x250 drivers/misc/vmw_vmci/vmci_context.c:195
vmci_host_do_init_context drivers/misc/vmw_vmci/vmci_host.c:341 [inline]
vmci_host_unlocked_ioctl+0x46a7/0x5340 drivers/misc/vmw_vmci/vmci_host.c:931
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0x239/0x400 fs/ioctl.c:893
__x64_sys_ioctl+0x97/0xe0 fs/ioctl.c:893
x64_sys_call+0x1ebe/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:17
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Local variable ev.i.i created at:
ctx_fire_notification drivers/misc/vmw_vmci/vmci_context.c:248 [inline]
ctx_free_ctx drivers/misc/vmw_vmci/vmci_context.c:435 [inline]
kref_put include/linux/kref.h:65 [inline]
vmci_ctx_put+0x76b/0x15d0 drivers/misc/vmw_vmci/vmci_context.c:497
vmci_ctx_destroy+0x15d/0x250 drivers/misc/vmw_vmci/vmci_context.c:195
Bytes 28-31 of 40 are uninitialized
Memory access of size 40 starts at ffff88804ac905c0
Data copied to user address 000000000000a4bf
CPU: 0 UID: 0 PID: 6748 Comm: syz.0.16 Not tainted 6.16.0-rc3-syzkaller-g86731a2a651e-dirty #0 PREEMPT(undef)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
=====================================================
Tested on:
commit: 86731a2a Linux 6.16-rc3
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1707a182580000
kernel config: https://syzkaller.appspot.com/x/.config?x=595d344ff0b23ac5
dashboard link: https://syzkaller.appspot.com/bug?extid=9b9124ae9b12d5af5d95
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
patch: https://syzkaller.appspot.com/x/patch.diff?x=1176f370580000
^ permalink raw reply [flat|nested] 23+ messages in thread
* Re: [syzbot] [kernel?] KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl (3)
[not found] <20250623080347.3056823-1-lizhi.xu@windriver.com>
@ 2025-06-23 8:36 ` syzbot
0 siblings, 0 replies; 23+ messages in thread
From: syzbot @ 2025-06-23 8:36 UTC (permalink / raw)
To: linux-kernel, lizhi.xu, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+9b9124ae9b12d5af5d95@syzkaller.appspotmail.com
Tested-by: syzbot+9b9124ae9b12d5af5d95@syzkaller.appspotmail.com
Tested on:
commit: 86731a2a Linux 6.16-rc3
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=10eff370580000
kernel config: https://syzkaller.appspot.com/x/.config?x=595d344ff0b23ac5
dashboard link: https://syzkaller.appspot.com/bug?extid=9b9124ae9b12d5af5d95
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
patch: https://syzkaller.appspot.com/x/patch.diff?x=11a46182580000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 23+ messages in thread
* Re: [syzbot] [kernel?] KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl (3)
[not found] <20250623085022.3182174-1-lizhi.xu@windriver.com>
@ 2025-06-23 9:28 ` syzbot
0 siblings, 0 replies; 23+ messages in thread
From: syzbot @ 2025-06-23 9:28 UTC (permalink / raw)
To: linux-kernel, lizhi.xu, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl
=====================================================
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
BUG: KMSAN: kernel-infoleak in _inline_copy_to_user include/linux/uaccess.h:196 [inline]
BUG: KMSAN: kernel-infoleak in _copy_to_user+0xcc/0x120 lib/usercopy.c:26
instrument_copy_to_user include/linux/instrumented.h:114 [inline]
_inline_copy_to_user include/linux/uaccess.h:196 [inline]
_copy_to_user+0xcc/0x120 lib/usercopy.c:26
copy_to_user include/linux/uaccess.h:225 [inline]
vmci_host_do_receive_datagram drivers/misc/vmw_vmci/vmci_host.c:442 [inline]
vmci_host_unlocked_ioctl+0x1d6f/0x52d0 drivers/misc/vmw_vmci/vmci_host.c:942
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0x239/0x400 fs/ioctl.c:893
__x64_sys_ioctl+0x97/0xe0 fs/ioctl.c:893
x64_sys_call+0x1ebe/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:17
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Local variable filename created at:
ima_file_mprotect+0x78/0x800 security/integrity/ima/ima_main.c:500
security_file_mprotect+0x141/0x590 security/security.c:3012
Bytes 28-31 of 40 are uninitialized
Memory access of size 40 starts at ffff888021ad2880
Data copied to user address 000000000000a4bf
CPU: 1 UID: 0 PID: 6749 Comm: syz.0.16 Not tainted 6.16.0-rc3-syzkaller-g86731a2a651e-dirty #0 PREEMPT(undef)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
=====================================================
Tested on:
commit: 86731a2a Linux 6.16-rc3
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=112fdb0c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=595d344ff0b23ac5
dashboard link: https://syzkaller.appspot.com/bug?extid=9b9124ae9b12d5af5d95
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
patch: https://syzkaller.appspot.com/x/patch.diff?x=16bff370580000
^ permalink raw reply [flat|nested] 23+ messages in thread
* Re: [syzbot] [kernel?] KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl (3)
[not found] <20250623094537.3353300-1-lizhi.xu@windriver.com>
@ 2025-06-23 12:11 ` syzbot
0 siblings, 0 replies; 23+ messages in thread
From: syzbot @ 2025-06-23 12:11 UTC (permalink / raw)
To: linux-kernel, lizhi.xu, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl
=====================================================
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
BUG: KMSAN: kernel-infoleak in _inline_copy_to_user include/linux/uaccess.h:196 [inline]
BUG: KMSAN: kernel-infoleak in _copy_to_user+0xcc/0x120 lib/usercopy.c:26
instrument_copy_to_user include/linux/instrumented.h:114 [inline]
_inline_copy_to_user include/linux/uaccess.h:196 [inline]
_copy_to_user+0xcc/0x120 lib/usercopy.c:26
copy_to_user include/linux/uaccess.h:225 [inline]
vmci_host_do_receive_datagram drivers/misc/vmw_vmci/vmci_host.c:445 [inline]
vmci_host_unlocked_ioctl+0x1e9b/0x52c0 drivers/misc/vmw_vmci/vmci_host.c:945
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0x239/0x400 fs/ioctl.c:893
__x64_sys_ioctl+0x97/0xe0 fs/ioctl.c:893
x64_sys_call+0x1ebe/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:17
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Local variable filename created at:
ima_file_mprotect+0x78/0x800 security/integrity/ima/ima_main.c:500
security_file_mprotect+0x141/0x590 security/security.c:3012
Bytes 28-31 of 40 are uninitialized
Memory access of size 40 starts at ffff888013c6bf80
Data copied to user address 000000000000a4bf
CPU: 0 UID: 0 PID: 6740 Comm: syz.0.16 Not tainted 6.16.0-rc3-syzkaller-g86731a2a651e-dirty #0 PREEMPT(undef)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
=====================================================
Tested on:
commit: 86731a2a Linux 6.16-rc3
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=150a0b70580000
kernel config: https://syzkaller.appspot.com/x/.config?x=595d344ff0b23ac5
dashboard link: https://syzkaller.appspot.com/bug?extid=9b9124ae9b12d5af5d95
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
patch: https://syzkaller.appspot.com/x/patch.diff?x=10726b0c580000
^ permalink raw reply [flat|nested] 23+ messages in thread
* Re: [syzbot] [kernel?] KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl (3)
2025-06-19 23:57 syzbot
` (2 preceding siblings ...)
2025-06-22 6:28 ` Hillf Danton
@ 2025-06-23 12:29 ` Edward Adam Davis
2025-06-23 13:45 ` syzbot
3 siblings, 1 reply; 23+ messages in thread
From: Edward Adam Davis @ 2025-06-23 12:29 UTC (permalink / raw)
To: syzbot+9b9124ae9b12d5af5d95; +Cc: linux-kernel, syzkaller-bugs
#syz test
diff --git a/drivers/misc/vmw_vmci/vmci_host.c b/drivers/misc/vmw_vmci/vmci_host.c
index b64944367ac5..4e500a8924c2 100644
--- a/drivers/misc/vmw_vmci/vmci_host.c
+++ b/drivers/misc/vmw_vmci/vmci_host.c
@@ -293,6 +293,8 @@ static int vmci_host_get_version(struct vmci_host_dev *vmci_host_dev,
#define vmci_ioctl_err(fmt, ...) \
pr_devel("%s: " fmt, ioctl_name, ##__VA_ARGS__)
+static DEFINE_MUTEX(init_rec_mutex);
+
static int vmci_host_do_init_context(struct vmci_host_dev *vmci_host_dev,
const char *ioctl_name,
void __user *uptr)
@@ -922,7 +924,9 @@ static long vmci_host_unlocked_ioctl(struct file *filp,
struct vmci_host_dev *vmci_host_dev = filp->private_data;
void __user *uptr = (void __user *)ioarg;
+ int ret = 0;
+ mutex_lock(&init_rec_mutex);
switch (iocmd) {
case IOCTL_VMCI_INIT_CONTEXT:
VMCI_DO_IOCTL(INIT_CONTEXT, init_context);
@@ -957,13 +961,16 @@ static long vmci_host_unlocked_ioctl(struct file *filp,
case IOCTL_VMCI_VERSION:
case IOCTL_VMCI_VERSION2:
- return vmci_host_get_version(vmci_host_dev, iocmd, uptr);
+ ret = vmci_host_get_version(vmci_host_dev, iocmd, uptr);
default:
pr_devel("%s: Unknown ioctl (iocmd=%d)\n", __func__, iocmd);
- return -EINVAL;
+ ret -EINVAL;
}
+ mutex_unlock(&init_rec_mutex);
+ return ret;
+
#undef VMCI_DO_IOCTL
}
^ permalink raw reply related [flat|nested] 23+ messages in thread
* Re: [syzbot] [kernel?] KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl (3)
2025-06-23 12:29 ` Edward Adam Davis
@ 2025-06-23 13:45 ` syzbot
0 siblings, 0 replies; 23+ messages in thread
From: syzbot @ 2025-06-23 13:45 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+9b9124ae9b12d5af5d95@syzkaller.appspotmail.com
Tested-by: syzbot+9b9124ae9b12d5af5d95@syzkaller.appspotmail.com
Tested on:
commit: 86731a2a Linux 6.16-rc3
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12553b0c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=595d344ff0b23ac5
dashboard link: https://syzkaller.appspot.com/bug?extid=9b9124ae9b12d5af5d95
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
patch: https://syzkaller.appspot.com/x/patch.diff?x=106e3b0c580000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 23+ messages in thread
* Re: [syzbot] [kernel?] KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl (3)
[not found] <20250626021712.2842722-1-lizhi.xu@windriver.com>
@ 2025-06-26 3:35 ` syzbot
0 siblings, 0 replies; 23+ messages in thread
From: syzbot @ 2025-06-26 3:35 UTC (permalink / raw)
To: linux-kernel, lizhi.xu, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+9b9124ae9b12d5af5d95@syzkaller.appspotmail.com
Tested-by: syzbot+9b9124ae9b12d5af5d95@syzkaller.appspotmail.com
Tested on:
commit: c4dce0c0 Merge tag 'spi-fix-v6.16-rc3' of git://git.ke..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=155df70c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=595d344ff0b23ac5
dashboard link: https://syzkaller.appspot.com/bug?extid=9b9124ae9b12d5af5d95
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
patch: https://syzkaller.appspot.com/x/patch.diff?x=178acf0c580000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 23+ messages in thread
* Re: [syzbot] [kernel?] KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl (3)
[not found] <20250626024902.2942685-1-lizhi.xu@windriver.com>
@ 2025-06-26 4:45 ` syzbot
0 siblings, 0 replies; 23+ messages in thread
From: syzbot @ 2025-06-26 4:45 UTC (permalink / raw)
To: linux-kernel, lizhi.xu, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+9b9124ae9b12d5af5d95@syzkaller.appspotmail.com
Tested-by: syzbot+9b9124ae9b12d5af5d95@syzkaller.appspotmail.com
Tested on:
commit: c4dce0c0 Merge tag 'spi-fix-v6.16-rc3' of git://git.ke..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12325b70580000
kernel config: https://syzkaller.appspot.com/x/.config?x=595d344ff0b23ac5
dashboard link: https://syzkaller.appspot.com/bug?extid=9b9124ae9b12d5af5d95
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
patch: https://syzkaller.appspot.com/x/patch.diff?x=165bbdd4580000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 23+ messages in thread
* Re: [syzbot] [kernel?] KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl (3)
[not found] <20250627032632.2470249-1-lizhi.xu@windriver.com>
@ 2025-06-27 4:54 ` syzbot
0 siblings, 0 replies; 23+ messages in thread
From: syzbot @ 2025-06-27 4:54 UTC (permalink / raw)
To: linux-kernel, lizhi.xu, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
BUG: unable to handle kernel NULL pointer dereference in ioctl
BUG: kernel NULL pointer dereference, address: 0000000000000320
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 8000000047e19067 P4D 8000000047e19067 PUD 0
Oops: Oops: 0000 [#1] SMP PTI
CPU: 1 UID: 0 PID: 6745 Comm: syz.0.16 Not tainted 6.16.0-rc3-syzkaller-g6f2a71a99ebd-dirty #0 PREEMPT(undef)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:vfs_ioctl fs/ioctl.c:51 [inline]
RIP: 0010:__do_sys_ioctl fs/ioctl.c:907 [inline]
RIP: 0010:__se_sys_ioctl+0x23f/0x400 fs/ioctl.c:893
Code: 83 20 03 00 00 00 00 00 00 49 83 fd 04 0f 83 b9 01 00 00 48 8b 7d c8 44 89 e6 48 8b 55 b0 4d 89 f3 2e e8 e0 4a 44 1d 49 89 c6 <44> 8b a3 20 03 00 00 8b 83 a8 0f 00 00 89 45 d4 c7 03 00 00 00 00
RSP: 0018:ffff88804a3dbe30 EFLAGS: 00010282
RAX: fffffffffffffff2 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 00000000219e67d0 RSI: 0000000000000001 RDI: ffff8880219e67d0
RBP: ffff88804a3dbe80 R08: ffffea000000000f R09: 0000000000000000
R10: ffff8880211e67d0 R11: ffffffff82831f32 R12: 00000000000007a0
R13: 0000000000000000 R14: fffffffffffffff2 R15: ffff888038101c01
FS: 00007f0f9a3e76c0(0000) GS:ffff8881aa97d000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000320 CR3: 0000000047176000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
__x64_sys_ioctl+0x97/0xe0 fs/ioctl.c:893
x64_sys_call+0x1ebe/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:17
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f0f9958e929
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f0f9a3e7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f0f997b5fa0 RCX: 00007f0f9958e929
RDX: 0000200000000140 RSI: 00000000000007a0 RDI: 0000000000000004
RBP: 00007f0f99610b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f0f997b5fa0 R15: 00007ffe024bc598
</TASK>
Modules linked in:
CR2: 0000000000000320
---[ end trace 0000000000000000 ]---
RIP: 0010:vfs_ioctl fs/ioctl.c:51 [inline]
RIP: 0010:__do_sys_ioctl fs/ioctl.c:907 [inline]
RIP: 0010:__se_sys_ioctl+0x23f/0x400 fs/ioctl.c:893
Code: 83 20 03 00 00 00 00 00 00 49 83 fd 04 0f 83 b9 01 00 00 48 8b 7d c8 44 89 e6 48 8b 55 b0 4d 89 f3 2e e8 e0 4a 44 1d 49 89 c6 <44> 8b a3 20 03 00 00 8b 83 a8 0f 00 00 89 45 d4 c7 03 00 00 00 00
RSP: 0018:ffff88804a3dbe30 EFLAGS: 00010282
RAX: fffffffffffffff2 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 00000000219e67d0 RSI: 0000000000000001 RDI: ffff8880219e67d0
RBP: ffff88804a3dbe80 R08: ffffea000000000f R09: 0000000000000000
R10: ffff8880211e67d0 R11: ffffffff82831f32 R12: 00000000000007a0
R13: 0000000000000000 R14: fffffffffffffff2 R15: ffff888038101c01
FS: 00007f0f9a3e76c0(0000) GS:ffff8881aa97d000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000320 CR3: 0000000047176000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 83 20 03 andl $0x3,(%rax)
3: 00 00 add %al,(%rax)
5: 00 00 add %al,(%rax)
7: 00 00 add %al,(%rax)
9: 49 83 fd 04 cmp $0x4,%r13
d: 0f 83 b9 01 00 00 jae 0x1cc
13: 48 8b 7d c8 mov -0x38(%rbp),%rdi
17: 44 89 e6 mov %r12d,%esi
1a: 48 8b 55 b0 mov -0x50(%rbp),%rdx
1e: 4d 89 f3 mov %r14,%r11
21: 2e e8 e0 4a 44 1d cs call 0x1d444b07
27: 49 89 c6 mov %rax,%r14
* 2a: 44 8b a3 20 03 00 00 mov 0x320(%rbx),%r12d <-- trapping instruction
31: 8b 83 a8 0f 00 00 mov 0xfa8(%rbx),%eax
37: 89 45 d4 mov %eax,-0x2c(%rbp)
3a: c7 03 00 00 00 00 movl $0x0,(%rbx)
Tested on:
commit: 6f2a71a9 Merge tag 'bcachefs-2025-06-26' of git://evil..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1720608c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=595d344ff0b23ac5
dashboard link: https://syzkaller.appspot.com/bug?extid=9b9124ae9b12d5af5d95
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
patch: https://syzkaller.appspot.com/x/patch.diff?x=103ba08c580000
^ permalink raw reply [flat|nested] 23+ messages in thread
* Re: [syzbot] [kernel?] KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl (3)
[not found] <20250627051303.2837086-1-lizhi.xu@windriver.com>
@ 2025-06-27 5:44 ` syzbot
0 siblings, 0 replies; 23+ messages in thread
From: syzbot @ 2025-06-27 5:44 UTC (permalink / raw)
To: linux-kernel, lizhi.xu, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+9b9124ae9b12d5af5d95@syzkaller.appspotmail.com
Tested-by: syzbot+9b9124ae9b12d5af5d95@syzkaller.appspotmail.com
Tested on:
commit: 67a99386 Merge tag 'v6.16-p6' of git://git.kernel.org/..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=134d3b70580000
kernel config: https://syzkaller.appspot.com/x/.config?x=595d344ff0b23ac5
dashboard link: https://syzkaller.appspot.com/bug?extid=9b9124ae9b12d5af5d95
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
patch: https://syzkaller.appspot.com/x/patch.diff?x=134a808c580000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 23+ messages in thread
* Re: [syzbot] [kernel?] KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl (3)
[not found] <20250703080919.1229530-1-lizhi.xu@windriver.com>
@ 2025-07-03 10:12 ` syzbot
0 siblings, 0 replies; 23+ messages in thread
From: syzbot @ 2025-07-03 10:12 UTC (permalink / raw)
To: linux-kernel, lizhi.xu, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+9b9124ae9b12d5af5d95@syzkaller.appspotmail.com
Tested-by: syzbot+9b9124ae9b12d5af5d95@syzkaller.appspotmail.com
Tested on:
commit: b4911fb0 Merge tag 'mmc-v6.16-rc1' of git://git.kernel..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13987770580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a5ea1eb5c71e117a
dashboard link: https://syzkaller.appspot.com/bug?extid=9b9124ae9b12d5af5d95
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
patch: https://syzkaller.appspot.com/x/patch.diff?x=1627f982580000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 23+ messages in thread
end of thread, other threads:[~2025-07-03 10:12 UTC | newest]
Thread overview: 23+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20250626021712.2842722-1-lizhi.xu@windriver.com>
2025-06-26 3:35 ` [syzbot] [kernel?] KMSAN: kernel-infoleak in vmci_host_unlocked_ioctl (3) syzbot
[not found] <20250703080919.1229530-1-lizhi.xu@windriver.com>
2025-07-03 10:12 ` syzbot
[not found] <20250627051303.2837086-1-lizhi.xu@windriver.com>
2025-06-27 5:44 ` syzbot
[not found] <20250627032632.2470249-1-lizhi.xu@windriver.com>
2025-06-27 4:54 ` syzbot
[not found] <20250626024902.2942685-1-lizhi.xu@windriver.com>
2025-06-26 4:45 ` syzbot
[not found] <20250623094537.3353300-1-lizhi.xu@windriver.com>
2025-06-23 12:11 ` syzbot
[not found] <20250623085022.3182174-1-lizhi.xu@windriver.com>
2025-06-23 9:28 ` syzbot
[not found] <20250623080347.3056823-1-lizhi.xu@windriver.com>
2025-06-23 8:36 ` syzbot
[not found] <20250623030312.2337101-1-lizhi.xu@windriver.com>
2025-06-23 4:28 ` syzbot
[not found] <20250620065432.1558000-1-lizhi.xu@windriver.com>
2025-06-20 10:02 ` syzbot
[not found] <20250620065230.1552640-1-lizhi.xu@windriver.com>
2025-06-20 8:49 ` syzbot
[not found] <20250620052310.1280771-1-lizhi.xu@windriver.com>
2025-06-20 5:58 ` syzbot
[not found] <20250620042056.1099990-1-lizhi.xu@windriver.com>
2025-06-20 4:28 ` syzbot
[not found] <20250620010300.3380487-1-lizhi.xu@windriver.com>
2025-06-20 2:55 ` syzbot
2025-06-19 23:57 syzbot
2025-06-22 2:37 ` Edward Adam Davis
2025-06-22 3:02 ` syzbot
2025-06-22 4:46 ` Hillf Danton
2025-06-22 5:19 ` syzbot
2025-06-22 6:28 ` Hillf Danton
2025-06-22 7:32 ` syzbot
2025-06-23 12:29 ` Edward Adam Davis
2025-06-23 13:45 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).