KMSAN: kernel-infoleak in nilfs_ioctl_wrap_copy

Status: fixed on 2023/06/08 14:41
Subsystems: nilfs
[Documentation on labels]
Reported-by: syzbot+132fdd2f1e1805fdc591@syzkaller.appspotmail.com
Fix commit: 003587000276 nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()
First crash: 1265d, last: 1229d
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[PATCH] nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() 1 (1) 2023/03/07 08:55
[syzbot] [nilfs?] KMSAN: kernel-infoleak in nilfs_ioctl_wrap_copy 0 (1) 2023/03/06 17:56
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: kernel-infoleak in vcs_read (2) serial 18 syz, C 1556 1289d 2444d 22/29 fixed on 2023/02/24 13:50
upstream KMSAN: uninit-value in set_selection_kernel serial 7 428 1449d 2345d 0/29 auto-obsoleted due to no activity on 2022/12/23 21:08

Sample crash report:
=====================================================
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:121 [inline]
BUG: KMSAN: kernel-infoleak in _copy_to_user+0xc0/0x100 lib/usercopy.c:40
 instrument_copy_to_user include/linux/instrumented.h:121 [inline]
 _copy_to_user+0xc0/0x100 lib/usercopy.c:40
 copy_to_user include/linux/uaccess.h:169 [inline]
 nilfs_ioctl_wrap_copy+0x6fa/0xc10 fs/nilfs2/ioctl.c:99
 nilfs_ioctl_get_info fs/nilfs2/ioctl.c:1173 [inline]
 nilfs_ioctl+0x2402/0x4450 fs/nilfs2/ioctl.c:1290
 nilfs_compat_ioctl+0x1b8/0x200 fs/nilfs2/ioctl.c:1343
 __do_compat_sys_ioctl fs/ioctl.c:968 [inline]
 __se_compat_sys_ioctl+0x7dd/0x1000 fs/ioctl.c:910
 __ia32_compat_sys_ioctl+0x93/0xd0 fs/ioctl.c:910
 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
 __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178
 do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203
 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246
 entry_SYSENTER_compat_after_hwframe+0x70/0x82

Uninit was created at:
 __alloc_pages+0x9f6/0xe90 mm/page_alloc.c:5614
 alloc_pages+0xab0/0xd80 mm/mempolicy.c:2283
 __get_free_pages+0x34/0xc0 mm/page_alloc.c:5641
 nilfs_ioctl_wrap_copy+0x223/0xc10 fs/nilfs2/ioctl.c:74
 nilfs_ioctl_get_info fs/nilfs2/ioctl.c:1173 [inline]
 nilfs_ioctl+0x2402/0x4450 fs/nilfs2/ioctl.c:1290
 nilfs_compat_ioctl+0x1b8/0x200 fs/nilfs2/ioctl.c:1343
 __do_compat_sys_ioctl fs/ioctl.c:968 [inline]
 __se_compat_sys_ioctl+0x7dd/0x1000 fs/ioctl.c:910
 __ia32_compat_sys_ioctl+0x93/0xd0 fs/ioctl.c:910
 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
 __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178
 do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203
 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246
 entry_SYSENTER_compat_after_hwframe+0x70/0x82

Bytes 16-127 of 640 are uninitialized
Memory access of size 640 starts at ffff88811a5f9000
Data copied to user address 000000002000002f

CPU: 1 PID: 5620 Comm: syz-executor.2 Not tainted 6.3.0-rc3-syzkaller-g90ea0df61c98 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
=====================================================

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/04/02 15:26 https://github.com/google/kmsan.git master 90ea0df61c98 f325deb0 .config console log report info ci-upstream-kmsan-gce-386 KMSAN: kernel-infoleak in nilfs_ioctl_wrap_copy
2023/03/24 12:10 https://github.com/google/kmsan.git master 90ea0df61c98 f94b4a29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386 KMSAN: kernel-infoleak in nilfs_ioctl_wrap_copy
2023/03/16 04:11 https://github.com/google/kmsan.git master 34add094f9de 18b58603 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386 KMSAN: kernel-infoleak in nilfs_ioctl_wrap_copy
2023/02/25 19:25 https://github.com/google/kmsan.git master 97e36f4aa06f ee50e71c .config console log report info ci-upstream-kmsan-gce-386 KMSAN: kernel-infoleak in nilfs_ioctl_wrap_copy
* Struck through repros no longer work on HEAD.