KMSAN: uninit-value in vmacache_find

Status: auto-closed as invalid on 2020/08/26 17:07
Subsystems: mm
[Documentation on labels]
First crash: 2350d, last: 2258d
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in exit_to_user_mode_loop (3) kernel 7 syz, C 2558 1511d 1770d 0/29 auto-closed as invalid on 2022/09/22 19:06

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in vmacache_find+0x296/0x740 mm/vmacache.c:73
CPU: 0 PID: 8979 Comm: syz-executor.5 Not tainted 5.7.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c9/0x220 lib/dump_stack.c:118
 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:121
 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215
 vmacache_find+0x296/0x740 mm/vmacache.c:73
 find_vma+0x7d/0x330 mm/mmap.c:2240
 do_user_addr_fault+0x63f/0x1600 arch/x86/mm/fault.c:1445
 do_page_fault+0x1ba/0x840 arch/x86/mm/fault.c:1555
 page_fault+0x4e/0x60 arch/x86/entry/entry_64.S:1213
RIP: 0010:__put_user_4+0x1c/0x30 arch/x86/lib/putuser.S:70
Code: 1f 00 c3 90 66 2e 0f 1f 84 00 00 00 00 00 65 48 8b 1c 25 00 7d 01 00 48 8b 9b d0 1a 00 00 48 83 eb 03 48 39 d9 73 4a 0f 1f 00 <89> 01 31 c0 0f 1f 00 c3 66 90 66 2e 0f 1f 84 00 00 00 00 00 65 48
RSP: 0018:ffffa02100f8bb88 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 00007fffffffeffd RCX: 0000000020001e38
RDX: ffffb02100f8bdd0 RSI: 0000000000000004 RDI: ffffa02100f8bdd0
RBP: ffffa02100f8be90 R08: 0000000000000002 R09: ffffa02100f8bb38
R10: 0000000000000004 R11: ffffffff99d4bbc0 R12: 0000000000000400
R13: 0000000020001e00 R14: ffff9798613a2858 R15: 0000000000000000
 __do_sys_sendmmsg net/socket.c:2535 [inline]
 __se_sys_sendmmsg+0xbd/0xe0 net/socket.c:2532
 __x64_sys_sendmmsg+0x56/0x70 net/socket.c:2532
 do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:297
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45ca29
Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fb1f0bd1c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 00000000004fc580 RCX: 000000000045ca29
RDX: 03fffffffffffe36 RSI: 0000000020001e00 RDI: 0000000000000003
RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 00000000000008dd R14: 00000000004cba1f R15: 00007fb1f0bd26d4

Uninit was stored to memory at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:144 [inline]
 kmsan_internal_chain_origin+0xad/0x130 mm/kmsan/kmsan.c:310
 __msan_chain_origin+0x50/0x90 mm/kmsan/kmsan_instr.c:165
 ___bpf_prog_run+0x6cbe/0x97a0 kernel/bpf/core.c:1391
 __bpf_prog_run32+0x101/0x170 kernel/bpf/core.c:1681
 bpf_dispatcher_nop_func include/linux/bpf.h:545 [inline]
 __bpf_prog_run_save_cb include/linux/filter.h:693 [inline]
 bpf_prog_run_save_cb include/linux/filter.h:707 [inline]
 sk_filter_trim_cap+0x42a/0xcc0 net/core/filter.c:119
 sk_filter include/linux/filter.h:833 [inline]
 unix_dgram_sendmsg+0x1987/0x3c30 net/unix/af_unix.c:1710
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg net/socket.c:672 [inline]
 ____sys_sendmsg+0x12b6/0x1350 net/socket.c:2362
 ___sys_sendmsg net/socket.c:2416 [inline]
 __sys_sendmmsg+0x5fe/0xd60 net/socket.c:2506
 __do_sys_sendmmsg net/socket.c:2535 [inline]
 __se_sys_sendmmsg+0xbd/0xe0 net/socket.c:2532
 __x64_sys_sendmmsg+0x56/0x70 net/socket.c:2532
 do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:297
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Uninit was stored to memory at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:144 [inline]
 kmsan_internal_chain_origin+0xad/0x130 mm/kmsan/kmsan.c:310
 __msan_chain_origin+0x50/0x90 mm/kmsan/kmsan_instr.c:165
 ___bpf_prog_run+0x6c64/0x97a0 kernel/bpf/core.c:1391
 __bpf_prog_run32+0x101/0x170 kernel/bpf/core.c:1681
 bpf_dispatcher_nop_func include/linux/bpf.h:545 [inline]
 __bpf_prog_run_save_cb include/linux/filter.h:693 [inline]
 bpf_prog_run_save_cb include/linux/filter.h:707 [inline]
 sk_filter_trim_cap+0x42a/0xcc0 net/core/filter.c:119
 sk_filter include/linux/filter.h:833 [inline]
 unix_dgram_sendmsg+0x1987/0x3c30 net/unix/af_unix.c:1710
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg net/socket.c:672 [inline]
 ____sys_sendmsg+0x12b6/0x1350 net/socket.c:2362
 ___sys_sendmsg net/socket.c:2416 [inline]
 __sys_sendmmsg+0x5fe/0xd60 net/socket.c:2506
 __do_sys_sendmmsg net/socket.c:2535 [inline]
 __se_sys_sendmmsg+0xbd/0xe0 net/socket.c:2532
 __x64_sys_sendmmsg+0x56/0x70 net/socket.c:2532
 do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:297
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Local variable ----regs@__bpf_prog_run32 created at:
 __bpf_prog_run32+0x87/0x170 kernel/bpf/core.c:1681
 __bpf_prog_run32+0x87/0x170 kernel/bpf/core.c:1681
=====================================================

Crashes (29):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/05/27 08:08 https://github.com/google/kmsan.git master 94bc4cd0c2f0 9072c126 .config console log report ci-upstream-kmsan-gce
2020/05/27 01:47 https://github.com/google/kmsan.git master 94bc4cd0c2f0 9072c126 .config console log report ci-upstream-kmsan-gce
2020/05/27 01:10 https://github.com/google/kmsan.git master 94bc4cd0c2f0 9072c126 .config console log report ci-upstream-kmsan-gce
2020/05/28 17:01 https://github.com/google/kmsan.git master 69b987d53462 0d951763 .config console log report ci-upstream-kmsan-gce-386
2020/05/27 01:30 https://github.com/google/kmsan.git master 94bc4cd0c2f0 9072c126 .config console log report ci-upstream-kmsan-gce-386
2020/05/11 12:13 https://github.com/google/kmsan.git master 14bcee29ad06 f8f57555 .config console log report ci-upstream-kmsan-gce-386
2020/05/02 23:45 https://github.com/google/kmsan.git master bfa90a4a3f3f 5457883a .config console log report ci-upstream-kmsan-gce-386
2020/05/01 19:24 https://github.com/google/kmsan.git master bfa90a4a3f3f bc734e7a .config console log report ci-upstream-kmsan-gce-386
2020/05/01 06:56 https://github.com/google/kmsan.git master bfa90a4a3f3f a4d01b80 .config console log report ci-upstream-kmsan-gce-386
2020/04/30 14:16 https://github.com/google/kmsan.git master bfa90a4a3f3f 3698959a .config console log report ci-upstream-kmsan-gce-386
2020/04/29 17:38 https://github.com/google/kmsan.git master bfa90a4a3f3f 496a08ae .config console log report ci-upstream-kmsan-gce-386
2020/04/29 14:37 https://github.com/google/kmsan.git master bfa90a4a3f3f 496a08ae .config console log report ci-upstream-kmsan-gce-386
2020/04/29 03:27 https://github.com/google/kmsan.git master bfa90a4a3f3f e3ecea2e .config console log report ci-upstream-kmsan-gce-386
2020/04/28 12:37 https://github.com/google/kmsan.git master bfa90a4a3f3f e3ecea2e .config console log report ci-upstream-kmsan-gce-386
2020/04/28 11:58 https://github.com/google/kmsan.git master bfa90a4a3f3f e3ecea2e .config console log report ci-upstream-kmsan-gce-386
2020/04/21 20:57 https://github.com/google/kmsan.git master 9535d09e7cff 2e44d63e .config console log report ci-upstream-kmsan-gce-386
2020/04/21 20:11 https://github.com/google/kmsan.git master 9535d09e7cff 2e44d63e .config console log report ci-upstream-kmsan-gce-386
2020/04/21 19:18 https://github.com/google/kmsan.git master 9535d09e7cff 2e44d63e .config console log report ci-upstream-kmsan-gce-386
2020/04/20 18:23 https://github.com/google/kmsan.git master 9535d09e7cff 347a5dc3 .config console log report ci-upstream-kmsan-gce-386
2020/04/17 20:55 https://github.com/google/kmsan.git master 5356842da2b5 435c6d53 .config console log report ci-upstream-kmsan-gce-386
2020/04/12 11:35 https://github.com/google/kmsan.git master 75303409203b 36b0b050 .config console log report ci-upstream-kmsan-gce-386
2020/04/09 23:12 https://github.com/google/kmsan.git master 75303409203b a8c6a3f8 .config console log report ci-upstream-kmsan-gce-386
2020/04/09 07:00 https://github.com/google/kmsan.git master 75303409203b a8c6a3f8 .config console log report ci-upstream-kmsan-gce-386
2020/03/31 03:53 https://github.com/google/kmsan.git master 75303409203b c8d1cc20 .config console log report ci-upstream-kmsan-gce-386
2020/03/17 22:55 https://github.com/google/kmsan.git master a58741ac26cc 97bc55ce .config console log report ci-upstream-kmsan-gce-386
2020/03/15 12:55 https://github.com/google/kmsan.git master 8bbbc5cf3dca 749688d2 .config console log report ci-upstream-kmsan-gce-386
2020/03/11 22:48 https://github.com/google/kmsan.git master 8bbbc5cf3dca e7caca8e .config console log report ci-upstream-kmsan-gce-386
2020/03/05 22:49 https://github.com/google/kmsan.git master 8bbbc5cf3dca c88c7b75 .config console log report ci-upstream-kmsan-gce-386
2020/02/26 19:23 https://github.com/google/kmsan.git master 8bbbc5cf3dca 59b57593 .config console log report ci-upstream-kmsan-gce-386
* Struck through repros no longer work on HEAD.