All of lore.kernel.org
 help / color / mirror / Atom feed
From: syzbot <syzbot+194dffdb8b22fc5d207a@syzkaller.appspotmail.com>
To: alsa-devel@alsa-project.org, linux-kernel@vger.kernel.org,
	perex@perex.cz, syzkaller-bugs@googlegroups.com, tiwai@suse.com
Subject: KMSAN: uninit-value in snd_midi_event_encode_byte
Date: Sun, 02 Sep 2018 12:29:03 -0700	[thread overview]
Message-ID: <000000000000feece60574e86f8d@google.com> (raw)

Hello,

syzbot found the following crash on:

HEAD commit:    2dca2cbde67a kmsan: fix build warnings with CONFIG_KMSAN=n
git tree:       https://github.com/google/kmsan.git/master
console output: https://syzkaller.appspot.com/x/log.txt?x=1660ef6a400000
kernel config:  https://syzkaller.appspot.com/x/.config?x=820d6393634b55e3
dashboard link: https://syzkaller.appspot.com/bug?extid=194dffdb8b22fc5d207a
compiler:       clang version 8.0.0 (trunk 339414)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+194dffdb8b22fc5d207a@syzkaller.appspotmail.com

==================================================================
BUG: KMSAN: uninit-value in snd_midi_event_encode_byte+0x569/0xff0  
sound/core/seq/seq_midi_event.c:195
CPU: 0 PID: 1623 Comm: kworker/0:1H Not tainted 4.19.0-rc1+ #36
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
Workqueue: events_highpri snd_vmidi_output_work
Call Trace:
  __dump_stack lib/dump_stack.c:77 [inline]
  dump_stack+0x14b/0x190 lib/dump_stack.c:113
  kmsan_report+0x183/0x2b0 mm/kmsan/kmsan.c:956
  __msan_warning+0x70/0xc0 mm/kmsan/kmsan_instr.c:645
  snd_midi_event_encode_byte+0x569/0xff0 sound/core/seq/seq_midi_event.c:195
  snd_vmidi_output_work+0x34e/0x5b0 sound/core/seq/seq_virmidi.c:161
  process_one_work+0x1605/0x1f40 kernel/workqueue.c:2153
  worker_thread+0x11a2/0x2590 kernel/workqueue.c:2296
  kthread+0x465/0x4a0 kernel/kthread.c:247
  ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:416

Uninit was stored to memory at:
  kmsan_save_stack_with_flags mm/kmsan/kmsan.c:256 [inline]
  kmsan_save_stack mm/kmsan/kmsan.c:271 [inline]
  kmsan_internal_chain_origin+0x128/0x210 mm/kmsan/kmsan.c:573
  __msan_chain_origin+0x69/0xc0 mm/kmsan/kmsan_instr.c:482
  __snd_rawmidi_transmit_peek sound/core/rawmidi.c:1103 [inline]
  snd_rawmidi_transmit+0xa75/0xbf0 sound/core/rawmidi.c:1228
  snd_vmidi_output_work+0x2ac/0x5b0 sound/core/seq/seq_virmidi.c:159
  process_one_work+0x1605/0x1f40 kernel/workqueue.c:2153
  worker_thread+0x11a2/0x2590 kernel/workqueue.c:2296
  kthread+0x465/0x4a0 kernel/kthread.c:247
  ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:416

Uninit was created at:
  kmsan_save_stack_with_flags mm/kmsan/kmsan.c:256 [inline]
  kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:181
  kmsan_kmalloc+0x98/0x100 mm/kmsan/kmsan_hooks.c:91
  __kmalloc_node+0x7bf/0x11c0 mm/slub.c:3828
  kmalloc_node include/linux/slab.h:555 [inline]
  kvmalloc_node+0x19d/0x3e0 mm/util.c:423
  kvmalloc include/linux/mm.h:577 [inline]
  snd_rawmidi_runtime_create sound/core/rawmidi.c:132 [inline]
  open_substream+0x3c8/0xaa0 sound/core/rawmidi.c:276
  rawmidi_open_priv+0x347/0x1000 sound/core/rawmidi.c:327
  snd_rawmidi_open+0x7d4/0x1120 sound/core/rawmidi.c:424
  soundcore_open+0x9be/0xa60 sound/sound_core.c:597
  chrdev_open+0xc26/0xdb0 fs/char_dev.c:417
  do_dentry_open+0xc9d/0x1660 fs/open.c:771
  vfs_open+0xaf/0xe0 fs/open.c:880
  do_last fs/namei.c:3418 [inline]
  path_openat+0x17a6/0x67c0 fs/namei.c:3534
  do_filp_open+0x259/0x610 fs/namei.c:3564
  do_sys_open+0x630/0x940 fs/open.c:1063
  __do_sys_open fs/open.c:1081 [inline]
  __se_sys_open fs/open.c:1076 [inline]
  __x64_sys_open+0xf2/0x130 fs/open.c:1076
  do_syscall_64+0x15b/0x220 arch/x86/entry/common.c:290
  entry_SYSCALL_64_after_hwframe+0x63/0xe7
==================================================================


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with  
syzbot.

             reply	other threads:[~2018-09-02 19:29 UTC|newest]

Thread overview: 22+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-09-02 19:29 syzbot [this message]
2018-09-03  1:53 ` KMSAN: uninit-value in snd_midi_event_encode_byte syzbot
2018-09-03 13:22   ` Takashi Iwai
2018-09-03 13:22     ` Takashi Iwai
2018-09-03 13:22     ` syzbot
2018-09-03 13:22       ` syzbot
2018-09-03 13:29       ` Takashi Iwai
2018-09-03 13:33         ` Dmitry Vyukov
2018-09-03 13:37           ` Takashi Iwai
2018-09-03 13:41             ` Dmitry Vyukov
2018-09-03 14:04               ` Takashi Iwai
2018-09-03 14:04                 ` Takashi Iwai
2018-09-03 14:19                 ` Dmitry Vyukov
2018-09-03 14:30                   ` Takashi Iwai
2018-09-03 14:54                     ` Dmitry Vyukov
2018-09-03 15:00                       ` Takashi Iwai
2018-09-03 15:06                         ` Dmitry Vyukov
2018-09-03 15:18                           ` Takashi Iwai
2018-09-03 17:25                             ` Dmitry Vyukov
2018-09-03 17:25                               ` Dmitry Vyukov
2018-09-03 21:35                               ` Takashi Iwai
2018-09-03 21:35                                 ` Takashi Iwai

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=000000000000feece60574e86f8d@google.com \
    --to=syzbot+194dffdb8b22fc5d207a@syzkaller.appspotmail.com \
    --cc=alsa-devel@alsa-project.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=perex@perex.cz \
    --cc=syzkaller-bugs@googlegroups.com \
    --cc=tiwai@suse.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.