All of lore.kernel.org
 help / color / mirror / Atom feed
* [syzbot] KMSAN: uninit-value in make_kuid
@ 2021-12-10 12:59 syzbot
  2021-12-11 10:05 ` Christian Brauner
  0 siblings, 1 reply; 2+ messages in thread
From: syzbot @ 2021-12-10 12:59 UTC (permalink / raw)
  To: akpm, christian.brauner, cxfcosmos, ebiederm, glider, legion,
	linux-kernel, serge, syzkaller-bugs

Hello,

syzbot found the following issue on:

HEAD commit:    b0f85c4ccdd4 kmsan: report: add dump_stack_print_info()
git tree:       https://github.com/google/kmsan.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=1704eaf9b00000
kernel config:  https://syzkaller.appspot.com/x/.config?x=e00a8959fdd3f3e8
dashboard link: https://syzkaller.appspot.com/bug?extid=ce39644883793043ee77
compiler:       clang version 14.0.0 (git@github.com:llvm/llvm-project.git 0996585c8e3b3d409494eb5f1cad714b9e1f7fb5), GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: i386

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ce39644883793043ee77@syzkaller.appspotmail.com

=====================================================
BUG: KMSAN: uninit-value in map_id_range_down_base kernel/user_namespace.c:288 [inline]
BUG: KMSAN: uninit-value in map_id_range_down kernel/user_namespace.c:302 [inline]
BUG: KMSAN: uninit-value in map_id_down kernel/user_namespace.c:317 [inline]
BUG: KMSAN: uninit-value in make_kuid+0x450/0xc70 kernel/user_namespace.c:394
 map_id_range_down_base kernel/user_namespace.c:288 [inline]
 map_id_range_down kernel/user_namespace.c:302 [inline]
 map_id_down kernel/user_namespace.c:317 [inline]
 make_kuid+0x450/0xc70 kernel/user_namespace.c:394
 p9pdu_vreadf net/9p/protocol.c:167 [inline]
 p9pdu_readf+0x1378/0x4fc0 net/9p/protocol.c:526
 p9pdu_vreadf net/9p/protocol.c:312 [inline]
 p9pdu_readf+0x1cd0/0x4fc0 net/9p/protocol.c:526
 p9_client_getattr_dotl+0x2de/0x7f0 net/9p/client.c:1768
 v9fs_refresh_inode_dotl+0xb9/0x320 fs/9p/vfs_inode_dotl.c:958
 v9fs_lookup_revalidate+0x33d/0x440 fs/9p/vfs_dentry.c:85
 complete_walk+0x5a0/0x680 fs/namei.c:914
 path_lookupat+0x441/0x8a0 fs/namei.c:2456
 filename_lookup+0x66e/0xa50 fs/namei.c:2480
 user_path_at_empty+0x135/0x430 fs/namei.c:2801
 user_path_at include/linux/namei.h:57 [inline]
 do_mount fs/namespace.c:3328 [inline]
 __do_sys_mount fs/namespace.c:3539 [inline]
 __se_sys_mount+0x7f9/0xa10 fs/namespace.c:3516
 __ia32_sys_mount+0x157/0x1b0 fs/namespace.c:3516
 do_syscall_32_irqs_on arch/x86/entry/common.c:114 [inline]
 __do_fast_syscall_32+0x96/0xf0 arch/x86/entry/common.c:180
 do_fast_syscall_32+0x34/0x70 arch/x86/entry/common.c:205
 do_SYSENTER_32+0x1b/0x20 arch/x86/entry/common.c:248
 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c

Uninit was stored to memory at:
 pdu_read net/9p/protocol.c:48 [inline]
 p9pdu_vreadf net/9p/protocol.c:163 [inline]
 p9pdu_readf+0x1288/0x4fc0 net/9p/protocol.c:526
 p9pdu_vreadf net/9p/protocol.c:312 [inline]
 p9pdu_readf+0x1cd0/0x4fc0 net/9p/protocol.c:526
 p9_client_getattr_dotl+0x2de/0x7f0 net/9p/client.c:1768
 v9fs_refresh_inode_dotl+0xb9/0x320 fs/9p/vfs_inode_dotl.c:958
 v9fs_lookup_revalidate+0x33d/0x440 fs/9p/vfs_dentry.c:85
 complete_walk+0x5a0/0x680 fs/namei.c:914
 path_lookupat+0x441/0x8a0 fs/namei.c:2456
 filename_lookup+0x66e/0xa50 fs/namei.c:2480
 user_path_at_empty+0x135/0x430 fs/namei.c:2801
 user_path_at include/linux/namei.h:57 [inline]
 do_mount fs/namespace.c:3328 [inline]
 __do_sys_mount fs/namespace.c:3539 [inline]
 __se_sys_mount+0x7f9/0xa10 fs/namespace.c:3516
 __ia32_sys_mount+0x157/0x1b0 fs/namespace.c:3516
 do_syscall_32_irqs_on arch/x86/entry/common.c:114 [inline]
 __do_fast_syscall_32+0x96/0xf0 arch/x86/entry/common.c:180
 do_fast_syscall_32+0x34/0x70 arch/x86/entry/common.c:205
 do_SYSENTER_32+0x1b/0x20 arch/x86/entry/common.c:248
 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c

Uninit was stored to memory at:
 _copy_to_iter+0x1697/0x25c0 lib/iov_iter.c:670
 __copy_page_to_iter lib/iov_iter.c:858 [inline]
 copy_page_to_iter+0x18b7/0x2650 lib/iov_iter.c:883
 pipe_read+0x12ca/0x2380 fs/pipe.c:305
 __kernel_read+0xb34/0x1380 fs/read_write.c:439
 kernel_read+0x278/0x490 fs/read_write.c:457
 p9_fd_read net/9p/trans_fd.c:263 [inline]
 p9_read_work+0x456/0x1bf0 net/9p/trans_fd.c:298
 process_one_work+0xdc2/0x1820 kernel/workqueue.c:2298
 worker_thread+0x10f1/0x2290 kernel/workqueue.c:2445
 kthread+0x721/0x850 kernel/kthread.c:327
 ret_from_fork+0x1f/0x30

Uninit was stored to memory at:
 _copy_from_iter+0x15eb/0x2520 lib/iov_iter.c:770
 copy_page_from_iter+0x1302/0x1330 lib/iov_iter.c:908
 pipe_write+0x2b9c/0x2dd0 fs/pipe.c:466
 __kernel_write+0xb3e/0x1380 fs/read_write.c:535
 kernel_write+0x47c/0xa50 fs/read_write.c:564
 p9_fd_write net/9p/trans_fd.c:428 [inline]
 p9_write_work+0xa41/0x17a0 net/9p/trans_fd.c:479
 process_one_work+0xdc2/0x1820 kernel/workqueue.c:2298
 worker_thread+0x10f1/0x2290 kernel/workqueue.c:2445
 kthread+0x721/0x850 kernel/kthread.c:327
 ret_from_fork+0x1f/0x30

Uninit was stored to memory at:
 pdu_write net/9p/protocol.c:57 [inline]
 p9pdu_vwritef+0x3799/0x5120 net/9p/protocol.c:379
 p9pdu_writef+0x23a/0x280 net/9p/protocol.c:539
 p9pdu_vwritef+0x21f0/0x5120 net/9p/protocol.c:490
 p9_client_prepare_req+0x9e3/0x1090 net/9p/client.c:703
 p9_client_rpc+0x276/0x1460 net/9p/client.c:734
 p9_client_setattr+0x115/0x2c0 net/9p/client.c:1894
 v9fs_vfs_setattr_dotl+0x7e2/0xd70 fs/9p/vfs_inode_dotl.c:588
 notify_change+0x1fe3/0x2170 fs/attr.c:410
 chown_common+0x84e/0xca0 fs/open.c:678
 do_fchownat+0x2f8/0x500 fs/open.c:709
 ksys_lchown include/linux/syscalls.h:1335 [inline]
 __do_sys_lchown16 kernel/uid16.c:30 [inline]
 __se_sys_lchown16 kernel/uid16.c:28 [inline]
 __ia32_sys_lchown16+0x200/0x250 kernel/uid16.c:28
 do_syscall_32_irqs_on arch/x86/entry/common.c:114 [inline]
 __do_fast_syscall_32+0x96/0xf0 arch/x86/entry/common.c:180
 do_fast_syscall_32+0x34/0x70 arch/x86/entry/common.c:205
 do_SYSENTER_32+0x1b/0x20 arch/x86/entry/common.c:248
 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c

Uninit was stored to memory at:
 p9pdu_vwritef+0x3d7f/0x5120 net/9p/protocol.c:378
 p9pdu_writef+0x23a/0x280 net/9p/protocol.c:539
 p9pdu_vwritef+0x21f0/0x5120 net/9p/protocol.c:490
 p9_client_prepare_req+0x9e3/0x1090 net/9p/client.c:703
 p9_client_rpc+0x276/0x1460 net/9p/client.c:734
 p9_client_setattr+0x115/0x2c0 net/9p/client.c:1894
 v9fs_vfs_setattr_dotl+0x7e2/0xd70 fs/9p/vfs_inode_dotl.c:588
 notify_change+0x1fe3/0x2170 fs/attr.c:410
 chown_common+0x84e/0xca0 fs/open.c:678
 do_fchownat+0x2f8/0x500 fs/open.c:709
 ksys_lchown include/linux/syscalls.h:1335 [inline]
 __do_sys_lchown16 kernel/uid16.c:30 [inline]
 __se_sys_lchown16 kernel/uid16.c:28 [inline]
 __ia32_sys_lchown16+0x200/0x250 kernel/uid16.c:28
 do_syscall_32_irqs_on arch/x86/entry/common.c:114 [inline]
 __do_fast_syscall_32+0x96/0xf0 arch/x86/entry/common.c:180
 do_fast_syscall_32+0x34/0x70 arch/x86/entry/common.c:205
 do_SYSENTER_32+0x1b/0x20 arch/x86/entry/common.c:248
 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c

Uninit was stored to memory at:
 v9fs_vfs_setattr_dotl+0x5c8/0xd70 fs/9p/vfs_inode_dotl.c:567
 notify_change+0x1fe3/0x2170 fs/attr.c:410
 chown_common+0x84e/0xca0 fs/open.c:678
 do_fchownat+0x2f8/0x500 fs/open.c:709
 ksys_lchown include/linux/syscalls.h:1335 [inline]
 __do_sys_lchown16 kernel/uid16.c:30 [inline]
 __se_sys_lchown16 kernel/uid16.c:28 [inline]
 __ia32_sys_lchown16+0x200/0x250 kernel/uid16.c:28
 do_syscall_32_irqs_on arch/x86/entry/common.c:114 [inline]
 __do_fast_syscall_32+0x96/0xf0 arch/x86/entry/common.c:180
 do_fast_syscall_32+0x34/0x70 arch/x86/entry/common.c:205
 do_SYSENTER_32+0x1b/0x20 arch/x86/entry/common.c:248
 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c

Local variable newattrs created at:
 chown_common+0x120/0xca0 fs/open.c:647
 do_fchownat+0x2f8/0x500 fs/open.c:709

CPU: 0 PID: 15704 Comm: syz-executor.2 Not tainted 5.16.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
=====================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

^ permalink raw reply	[flat|nested] 2+ messages in thread
* Re: [syzbot] KMSAN: uninit-value in make_kuid
  2021-12-10 12:59 [syzbot] KMSAN: uninit-value in make_kuid syzbot
@ 2021-12-11 10:05 ` Christian Brauner
  0 siblings, 0 replies; 2+ messages in thread
From: Christian Brauner @ 2021-12-11 10:05 UTC (permalink / raw)
  To: syzbot
  Cc: akpm, cxfcosmos, ebiederm, glider, legion, linux-kernel, serge,
	syzkaller-bugs

On Fri, Dec 10, 2021 at 04:59:26AM -0800, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    b0f85c4ccdd4 kmsan: report: add dump_stack_print_info()
> git tree:       https://github.com/google/kmsan.git master
> console output: https://syzkaller.appspot.com/x/log.txt?x=1704eaf9b00000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=e00a8959fdd3f3e8
> dashboard link: https://syzkaller.appspot.com/bug?extid=ce39644883793043ee77
> compiler:       clang version 14.0.0 (git@github.com:llvm/llvm-project.git 0996585c8e3b3d409494eb5f1cad714b9e1f7fb5), GNU ld (GNU Binutils for Debian) 2.35.2
> userspace arch: i386
> 
> Unfortunately, I don't have any reproducer for this issue yet.
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+ce39644883793043ee77@syzkaller.appspotmail.com

I think this is triggered by the same 9p bug where it copies
uninitialized memory during setattr and then proceeds to send that
uninitialized memory over the wire. A patch for this was sent to 9p
devel but it seems to not have made it into mainline or -next just yet:
https://sourceforge.net/p/v9fs/mailman/message/37392685/

^ permalink raw reply	[flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-12-11 10:05 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-12-10 12:59 [syzbot] KMSAN: uninit-value in make_kuid syzbot
2021-12-11 10:05 ` Christian Brauner

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.