* KMSAN: uninit-value in snd_midi_event_encode_byte
@ 2018-09-02 19:29 syzbot
2018-09-03 1:53 ` syzbot
0 siblings, 1 reply; 17+ messages in thread
From: syzbot @ 2018-09-02 19:29 UTC (permalink / raw)
To: alsa-devel, linux-kernel, perex, syzkaller-bugs, tiwai
Hello,
syzbot found the following crash on:
HEAD commit: 2dca2cbde67a kmsan: fix build warnings with CONFIG_KMSAN=n
git tree: https://github.com/google/kmsan.git/master
console output: https://syzkaller.appspot.com/x/log.txt?x=1660ef6a400000
kernel config: https://syzkaller.appspot.com/x/.config?x=820d6393634b55e3
dashboard link: https://syzkaller.appspot.com/bug?extid=194dffdb8b22fc5d207a
compiler: clang version 8.0.0 (trunk 339414)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+194dffdb8b22fc5d207a@syzkaller.appspotmail.com
==================================================================
BUG: KMSAN: uninit-value in snd_midi_event_encode_byte+0x569/0xff0
sound/core/seq/seq_midi_event.c:195
CPU: 0 PID: 1623 Comm: kworker/0:1H Not tainted 4.19.0-rc1+ #36
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events_highpri snd_vmidi_output_work
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x14b/0x190 lib/dump_stack.c:113
kmsan_report+0x183/0x2b0 mm/kmsan/kmsan.c:956
__msan_warning+0x70/0xc0 mm/kmsan/kmsan_instr.c:645
snd_midi_event_encode_byte+0x569/0xff0 sound/core/seq/seq_midi_event.c:195
snd_vmidi_output_work+0x34e/0x5b0 sound/core/seq/seq_virmidi.c:161
process_one_work+0x1605/0x1f40 kernel/workqueue.c:2153
worker_thread+0x11a2/0x2590 kernel/workqueue.c:2296
kthread+0x465/0x4a0 kernel/kthread.c:247
ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:416
Uninit was stored to memory at:
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:256 [inline]
kmsan_save_stack mm/kmsan/kmsan.c:271 [inline]
kmsan_internal_chain_origin+0x128/0x210 mm/kmsan/kmsan.c:573
__msan_chain_origin+0x69/0xc0 mm/kmsan/kmsan_instr.c:482
__snd_rawmidi_transmit_peek sound/core/rawmidi.c:1103 [inline]
snd_rawmidi_transmit+0xa75/0xbf0 sound/core/rawmidi.c:1228
snd_vmidi_output_work+0x2ac/0x5b0 sound/core/seq/seq_virmidi.c:159
process_one_work+0x1605/0x1f40 kernel/workqueue.c:2153
worker_thread+0x11a2/0x2590 kernel/workqueue.c:2296
kthread+0x465/0x4a0 kernel/kthread.c:247
ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:416
Uninit was created at:
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:256 [inline]
kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:181
kmsan_kmalloc+0x98/0x100 mm/kmsan/kmsan_hooks.c:91
__kmalloc_node+0x7bf/0x11c0 mm/slub.c:3828
kmalloc_node include/linux/slab.h:555 [inline]
kvmalloc_node+0x19d/0x3e0 mm/util.c:423
kvmalloc include/linux/mm.h:577 [inline]
snd_rawmidi_runtime_create sound/core/rawmidi.c:132 [inline]
open_substream+0x3c8/0xaa0 sound/core/rawmidi.c:276
rawmidi_open_priv+0x347/0x1000 sound/core/rawmidi.c:327
snd_rawmidi_open+0x7d4/0x1120 sound/core/rawmidi.c:424
soundcore_open+0x9be/0xa60 sound/sound_core.c:597
chrdev_open+0xc26/0xdb0 fs/char_dev.c:417
do_dentry_open+0xc9d/0x1660 fs/open.c:771
vfs_open+0xaf/0xe0 fs/open.c:880
do_last fs/namei.c:3418 [inline]
path_openat+0x17a6/0x67c0 fs/namei.c:3534
do_filp_open+0x259/0x610 fs/namei.c:3564
do_sys_open+0x630/0x940 fs/open.c:1063
__do_sys_open fs/open.c:1081 [inline]
__se_sys_open fs/open.c:1076 [inline]
__x64_sys_open+0xf2/0x130 fs/open.c:1076
do_syscall_64+0x15b/0x220 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x63/0xe7
==================================================================
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: KMSAN: uninit-value in snd_midi_event_encode_byte
2018-09-02 19:29 KMSAN: uninit-value in snd_midi_event_encode_byte syzbot
@ 2018-09-03 1:53 ` syzbot
2018-09-03 13:22 ` Takashi Iwai
0 siblings, 1 reply; 17+ messages in thread
From: syzbot @ 2018-09-03 1:53 UTC (permalink / raw)
To: alsa-devel-bounces, alsa-devel, linux-kernel, perex,
syzkaller-bugs, tiwai
syzbot has found a reproducer for the following crash on:
HEAD commit: 28f0ca98eadf kmsan: don't instrument do_syscall_64() and _..
git tree: https://github.com/google/kmsan.git/master
console output: https://syzkaller.appspot.com/x/log.txt?x=10556c92400000
kernel config: https://syzkaller.appspot.com/x/.config?x=3431f03869413153
dashboard link: https://syzkaller.appspot.com/bug?extid=194dffdb8b22fc5d207a
compiler: clang version 8.0.0 (trunk 339414)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=123a520a400000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16068dc1400000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+194dffdb8b22fc5d207a@syzkaller.appspotmail.com
==================================================================
BUG: KMSAN: uninit-value in snd_midi_event_encode_byte+0x569/0xff0
sound/core/seq/seq_midi_event.c:195
CPU: 1 PID: 1659 Comm: kworker/1:1H Not tainted 4.19.0-rc1+ #40
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: events_highpri snd_vmidi_output_work
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x14b/0x190 lib/dump_stack.c:113
kmsan_report+0x183/0x2b0 mm/kmsan/kmsan.c:956
__msan_warning+0x70/0xc0 mm/kmsan/kmsan_instr.c:645
snd_midi_event_encode_byte+0x569/0xff0 sound/core/seq/seq_midi_event.c:195
snd_vmidi_output_work+0x34e/0x5b0 sound/core/seq/seq_virmidi.c:161
process_one_work+0x1605/0x1f40 kernel/workqueue.c:2153
worker_thread+0x11a2/0x2590 kernel/workqueue.c:2296
kthread+0x465/0x4a0 kernel/kthread.c:247
ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:416
Uninit was stored to memory at:
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:256 [inline]
kmsan_save_stack mm/kmsan/kmsan.c:271 [inline]
kmsan_internal_chain_origin+0x128/0x210 mm/kmsan/kmsan.c:573
__msan_chain_origin+0x69/0xc0 mm/kmsan/kmsan_instr.c:482
__snd_rawmidi_transmit_peek sound/core/rawmidi.c:1103 [inline]
snd_rawmidi_transmit+0xa75/0xbf0 sound/core/rawmidi.c:1228
snd_vmidi_output_work+0x2ac/0x5b0 sound/core/seq/seq_virmidi.c:159
process_one_work+0x1605/0x1f40 kernel/workqueue.c:2153
worker_thread+0x11a2/0x2590 kernel/workqueue.c:2296
kthread+0x465/0x4a0 kernel/kthread.c:247
ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:416
Uninit was created at:
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:256 [inline]
kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:181
kmsan_kmalloc+0x98/0x100 mm/kmsan/kmsan_hooks.c:91
__kmalloc_node+0x7bf/0x11c0 mm/slub.c:3828
kmalloc_node include/linux/slab.h:555 [inline]
kvmalloc_node+0x19d/0x3e0 mm/util.c:423
kvmalloc include/linux/mm.h:577 [inline]
snd_rawmidi_runtime_create sound/core/rawmidi.c:132 [inline]
open_substream+0x3c8/0xaa0 sound/core/rawmidi.c:276
rawmidi_open_priv+0x347/0x1000 sound/core/rawmidi.c:327
snd_rawmidi_open+0x7d4/0x1120 sound/core/rawmidi.c:424
soundcore_open+0x9be/0xa60 sound/sound_core.c:597
chrdev_open+0xc26/0xdb0 fs/char_dev.c:417
do_dentry_open+0xce6/0x1740 fs/open.c:771
vfs_open+0xaf/0xe0 fs/open.c:880
do_last fs/namei.c:3418 [inline]
path_openat+0x1799/0x6870 fs/namei.c:3534
do_filp_open+0x259/0x610 fs/namei.c:3564
do_sys_open+0x630/0x940 fs/open.c:1063
__do_sys_open fs/open.c:1081 [inline]
__se_sys_open+0xad/0xc0 fs/open.c:1076
__x64_sys_open+0x4a/0x70 fs/open.c:1076
do_syscall_64+0xb8/0x100 arch/x86/entry/common.c:291
entry_SYSCALL_64_after_hwframe+0x63/0xe7
==================================================================
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: KMSAN: uninit-value in snd_midi_event_encode_byte
2018-09-03 1:53 ` syzbot
@ 2018-09-03 13:22 ` Takashi Iwai
2018-09-03 13:22 ` syzbot
0 siblings, 1 reply; 17+ messages in thread
From: Takashi Iwai @ 2018-09-03 13:22 UTC (permalink / raw)
To: syzbot
Cc: alsa-devel, alsa-devel-bounces, syzkaller-bugs, perex, linux-kernel
On Mon, 03 Sep 2018 03:53:03 +0200,
syzbot wrote:
>
> syzbot has found a reproducer for the following crash on:
>
> HEAD commit: 28f0ca98eadf kmsan: don't instrument do_syscall_64() and _..
> git tree: https://github.com/google/kmsan.git/master
> console output: https://syzkaller.appspot.com/x/log.txt?x=10556c92400000
> kernel config: https://syzkaller.appspot.com/x/.config?x=3431f03869413153
> dashboard link: https://syzkaller.appspot.com/bug?extid=194dffdb8b22fc5d207a
> compiler: clang version 8.0.0 (trunk 339414)
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=123a520a400000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16068dc1400000
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+194dffdb8b22fc5d207a@syzkaller.appspotmail.com
>
> ==================================================================
> BUG: KMSAN: uninit-value in snd_midi_event_encode_byte+0x569/0xff0
> sound/core/seq/seq_midi_event.c:195
> CPU: 1 PID: 1659 Comm: kworker/1:1H Not tainted 4.19.0-rc1+ #40
> Hardware name: Google Google Compute Engine/Google Compute Engine,
> BIOS Google 01/01/2011
> Workqueue: events_highpri snd_vmidi_output_work
> Call Trace:
> __dump_stack lib/dump_stack.c:77 [inline]
> dump_stack+0x14b/0x190 lib/dump_stack.c:113
> kmsan_report+0x183/0x2b0 mm/kmsan/kmsan.c:956
> __msan_warning+0x70/0xc0 mm/kmsan/kmsan_instr.c:645
> snd_midi_event_encode_byte+0x569/0xff0 sound/core/seq/seq_midi_event.c:195
> snd_vmidi_output_work+0x34e/0x5b0 sound/core/seq/seq_virmidi.c:161
> process_one_work+0x1605/0x1f40 kernel/workqueue.c:2153
> worker_thread+0x11a2/0x2590 kernel/workqueue.c:2296
> kthread+0x465/0x4a0 kernel/kthread.c:247
> ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:416
>
> Uninit was stored to memory at:
> kmsan_save_stack_with_flags mm/kmsan/kmsan.c:256 [inline]
> kmsan_save_stack mm/kmsan/kmsan.c:271 [inline]
> kmsan_internal_chain_origin+0x128/0x210 mm/kmsan/kmsan.c:573
> __msan_chain_origin+0x69/0xc0 mm/kmsan/kmsan_instr.c:482
> __snd_rawmidi_transmit_peek sound/core/rawmidi.c:1103 [inline]
> snd_rawmidi_transmit+0xa75/0xbf0 sound/core/rawmidi.c:1228
> snd_vmidi_output_work+0x2ac/0x5b0 sound/core/seq/seq_virmidi.c:159
> process_one_work+0x1605/0x1f40 kernel/workqueue.c:2153
> worker_thread+0x11a2/0x2590 kernel/workqueue.c:2296
> kthread+0x465/0x4a0 kernel/kthread.c:247
> ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:416
>
> Uninit was created at:
> kmsan_save_stack_with_flags mm/kmsan/kmsan.c:256 [inline]
> kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:181
> kmsan_kmalloc+0x98/0x100 mm/kmsan/kmsan_hooks.c:91
> __kmalloc_node+0x7bf/0x11c0 mm/slub.c:3828
> kmalloc_node include/linux/slab.h:555 [inline]
> kvmalloc_node+0x19d/0x3e0 mm/util.c:423
> kvmalloc include/linux/mm.h:577 [inline]
> snd_rawmidi_runtime_create sound/core/rawmidi.c:132 [inline]
> open_substream+0x3c8/0xaa0 sound/core/rawmidi.c:276
> rawmidi_open_priv+0x347/0x1000 sound/core/rawmidi.c:327
> snd_rawmidi_open+0x7d4/0x1120 sound/core/rawmidi.c:424
> soundcore_open+0x9be/0xa60 sound/sound_core.c:597
> chrdev_open+0xc26/0xdb0 fs/char_dev.c:417
> do_dentry_open+0xce6/0x1740 fs/open.c:771
> vfs_open+0xaf/0xe0 fs/open.c:880
> do_last fs/namei.c:3418 [inline]
> path_openat+0x1799/0x6870 fs/namei.c:3534
> do_filp_open+0x259/0x610 fs/namei.c:3564
> do_sys_open+0x630/0x940 fs/open.c:1063
> __do_sys_open fs/open.c:1081 [inline]
> __se_sys_open+0xad/0xc0 fs/open.c:1076
> __x64_sys_open+0x4a/0x70 fs/open.c:1076
> do_syscall_64+0xb8/0x100 arch/x86/entry/common.c:291
> entry_SYSCALL_64_after_hwframe+0x63/0xe7
> ==================================================================
This looks like some small race at virmidi reading and the buffer
handling, which should be almost harmless by itself.
Nevertheless, the fix should be easy, just replacing kvmalloc() with
kvzalloc(), as below.
Let's check whether this works.
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git topic/rawmidi-fixes
Takashi
-- 8< --
From: Takashi Iwai <tiwai@suse.de>
Subject: [PATCH] ALSA: rawmidi: Initialize allocated buffers
syzbot reported the uninitialized value exposure in certain situations
using virmidi loop. It's likely a very small race at writing and
reading, and the influence is almost negligible. But it's safer to
paper over this just by replacing the existing kvmalloc() with
kvzalloc().
Reported-by: syzbot+194dffdb8b22fc5d207a@syzkaller.appspotmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
sound/core/rawmidi.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
index 69517e18ef07..08d5662039e3 100644
--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@ -129,7 +129,7 @@ static int snd_rawmidi_runtime_create(struct snd_rawmidi_substream *substream)
runtime->avail = 0;
else
runtime->avail = runtime->buffer_size;
- runtime->buffer = kvmalloc(runtime->buffer_size, GFP_KERNEL);
+ runtime->buffer = kvzalloc(runtime->buffer_size, GFP_KERNEL);
if (!runtime->buffer) {
kfree(runtime);
return -ENOMEM;
@@ -655,7 +655,7 @@ static int resize_runtime_buffer(struct snd_rawmidi_runtime *runtime,
if (params->avail_min < 1 || params->avail_min > params->buffer_size)
return -EINVAL;
if (params->buffer_size != runtime->buffer_size) {
- newbuf = kvmalloc(params->buffer_size, GFP_KERNEL);
+ newbuf = kvzalloc(params->buffer_size, GFP_KERNEL);
if (!newbuf)
return -ENOMEM;
spin_lock_irq(&runtime->lock);
--
2.18.0
^ permalink raw reply related [flat|nested] 17+ messages in thread
* Re: Re: KMSAN: uninit-value in snd_midi_event_encode_byte
2018-09-03 13:22 ` Takashi Iwai
@ 2018-09-03 13:22 ` syzbot
2018-09-03 13:29 ` Takashi Iwai
0 siblings, 1 reply; 17+ messages in thread
From: syzbot @ 2018-09-03 13:22 UTC (permalink / raw)
To: Takashi Iwai
Cc: alsa-devel-bounces, alsa-devel, linux-kernel, perex,
syzkaller-bugs, tiwai
> On Mon, 03 Sep 2018 03:53:03 +0200,
> syzbot wrote:
>> syzbot has found a reproducer for the following crash on:
>> HEAD commit: 28f0ca98eadf kmsan: don't instrument do_syscall_64() and
>> _..
>> git tree: https://github.com/google/kmsan.git/master
>> console output: https://syzkaller.appspot.com/x/log.txt?x=10556c92400000
>> kernel config:
>> https://syzkaller.appspot.com/x/.config?x=3431f03869413153
>> dashboard link:
>> https://syzkaller.appspot.com/bug?extid=194dffdb8b22fc5d207a
>> compiler: clang version 8.0.0 (trunk 339414)
>> syz repro:
>> https://syzkaller.appspot.com/x/repro.syz?x=123a520a400000
>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16068dc1400000
>> IMPORTANT: if you fix the bug, please add the following tag to the
>> commit:
>> Reported-by: syzbot+194dffdb8b22fc5d207a@syzkaller.appspotmail.com
>> ==================================================================
>> BUG: KMSAN: uninit-value in snd_midi_event_encode_byte+0x569/0xff0
>> sound/core/seq/seq_midi_event.c:195
>> CPU: 1 PID: 1659 Comm: kworker/1:1H Not tainted 4.19.0-rc1+ #40
>> Hardware name: Google Google Compute Engine/Google Compute Engine,
>> BIOS Google 01/01/2011
>> Workqueue: events_highpri snd_vmidi_output_work
>> Call Trace:
>> __dump_stack lib/dump_stack.c:77 [inline]
>> dump_stack+0x14b/0x190 lib/dump_stack.c:113
>> kmsan_report+0x183/0x2b0 mm/kmsan/kmsan.c:956
>> __msan_warning+0x70/0xc0 mm/kmsan/kmsan_instr.c:645
>> snd_midi_event_encode_byte+0x569/0xff0
>> sound/core/seq/seq_midi_event.c:195
>> snd_vmidi_output_work+0x34e/0x5b0 sound/core/seq/seq_virmidi.c:161
>> process_one_work+0x1605/0x1f40 kernel/workqueue.c:2153
>> worker_thread+0x11a2/0x2590 kernel/workqueue.c:2296
>> kthread+0x465/0x4a0 kernel/kthread.c:247
>> ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:416
>> Uninit was stored to memory at:
>> kmsan_save_stack_with_flags mm/kmsan/kmsan.c:256 [inline]
>> kmsan_save_stack mm/kmsan/kmsan.c:271 [inline]
>> kmsan_internal_chain_origin+0x128/0x210 mm/kmsan/kmsan.c:573
>> __msan_chain_origin+0x69/0xc0 mm/kmsan/kmsan_instr.c:482
>> __snd_rawmidi_transmit_peek sound/core/rawmidi.c:1103 [inline]
>> snd_rawmidi_transmit+0xa75/0xbf0 sound/core/rawmidi.c:1228
>> snd_vmidi_output_work+0x2ac/0x5b0 sound/core/seq/seq_virmidi.c:159
>> process_one_work+0x1605/0x1f40 kernel/workqueue.c:2153
>> worker_thread+0x11a2/0x2590 kernel/workqueue.c:2296
>> kthread+0x465/0x4a0 kernel/kthread.c:247
>> ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:416
>> Uninit was created at:
>> kmsan_save_stack_with_flags mm/kmsan/kmsan.c:256 [inline]
>> kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:181
>> kmsan_kmalloc+0x98/0x100 mm/kmsan/kmsan_hooks.c:91
>> __kmalloc_node+0x7bf/0x11c0 mm/slub.c:3828
>> kmalloc_node include/linux/slab.h:555 [inline]
>> kvmalloc_node+0x19d/0x3e0 mm/util.c:423
>> kvmalloc include/linux/mm.h:577 [inline]
>> snd_rawmidi_runtime_create sound/core/rawmidi.c:132 [inline]
>> open_substream+0x3c8/0xaa0 sound/core/rawmidi.c:276
>> rawmidi_open_priv+0x347/0x1000 sound/core/rawmidi.c:327
>> snd_rawmidi_open+0x7d4/0x1120 sound/core/rawmidi.c:424
>> soundcore_open+0x9be/0xa60 sound/sound_core.c:597
>> chrdev_open+0xc26/0xdb0 fs/char_dev.c:417
>> do_dentry_open+0xce6/0x1740 fs/open.c:771
>> vfs_open+0xaf/0xe0 fs/open.c:880
>> do_last fs/namei.c:3418 [inline]
>> path_openat+0x1799/0x6870 fs/namei.c:3534
>> do_filp_open+0x259/0x610 fs/namei.c:3564
>> do_sys_open+0x630/0x940 fs/open.c:1063
>> __do_sys_open fs/open.c:1081 [inline]
>> __se_sys_open+0xad/0xc0 fs/open.c:1076
>> __x64_sys_open+0x4a/0x70 fs/open.c:1076
>> do_syscall_64+0xb8/0x100 arch/x86/entry/common.c:291
>> entry_SYSCALL_64_after_hwframe+0x63/0xe7
>> ==================================================================
> This looks like some small race at virmidi reading and the buffer
> handling, which should be almost harmless by itself.
> Nevertheless, the fix should be easy, just replacing kvmalloc() with
> kvzalloc(), as below.
> Let's check whether this works.
> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git
> topic/rawmidi-fixes
KMSAN bugs can only be tested on https://github.com/google/kmsan.git tree
because KMSAN tool is not upstreamed yet.
See
https://github.com/google/syzkaller/blob/master/docs/syzbot.md#kmsan-bugs
for details.
> Takashi
> -- 8< --
> From: Takashi Iwai <tiwai@suse.de>
> Subject: [PATCH] ALSA: rawmidi: Initialize allocated buffers
> syzbot reported the uninitialized value exposure in certain situations
> using virmidi loop. It's likely a very small race at writing and
> reading, and the influence is almost negligible. But it's safer to
> paper over this just by replacing the existing kvmalloc() with
> kvzalloc().
> Reported-by: syzbot+194dffdb8b22fc5d207a@syzkaller.appspotmail.com
> Signed-off-by: Takashi Iwai <tiwai@suse.de>
> ---
> sound/core/rawmidi.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
> diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
> index 69517e18ef07..08d5662039e3 100644
> --- a/sound/core/rawmidi.c
> +++ b/sound/core/rawmidi.c
> @@ -129,7 +129,7 @@ static int snd_rawmidi_runtime_create(struct
> snd_rawmidi_substream *substream)
> runtime->avail = 0;
> else
> runtime->avail = runtime->buffer_size;
> - runtime->buffer = kvmalloc(runtime->buffer_size, GFP_KERNEL);
> + runtime->buffer = kvzalloc(runtime->buffer_size, GFP_KERNEL);
> if (!runtime->buffer) {
> kfree(runtime);
> return -ENOMEM;
> @@ -655,7 +655,7 @@ static int resize_runtime_buffer(struct
> snd_rawmidi_runtime *runtime,
> if (params->avail_min < 1 || params->avail_min > params->buffer_size)
> return -EINVAL;
> if (params->buffer_size != runtime->buffer_size) {
> - newbuf = kvmalloc(params->buffer_size, GFP_KERNEL);
> + newbuf = kvzalloc(params->buffer_size, GFP_KERNEL);
> if (!newbuf)
> return -ENOMEM;
> spin_lock_irq(&runtime->lock);
> --
> 2.18.0
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: KMSAN: uninit-value in snd_midi_event_encode_byte
2018-09-03 13:22 ` syzbot
@ 2018-09-03 13:29 ` Takashi Iwai
2018-09-03 13:33 ` Dmitry Vyukov
0 siblings, 1 reply; 17+ messages in thread
From: Takashi Iwai @ 2018-09-03 13:29 UTC (permalink / raw)
To: Dmitry Vyukov
Cc: syzbot, alsa-devel-bounces, alsa-devel, linux-kernel, perex,
syzkaller-bugs
On Mon, 03 Sep 2018 15:22:42 +0200,
syzbot wrote:
>
> > On Mon, 03 Sep 2018 03:53:03 +0200,
> > syzbot wrote:
>
> >> syzbot has found a reproducer for the following crash on:
>
> >> HEAD commit: 28f0ca98eadf kmsan: don't instrument
> >> do_syscall_64() and _..
> >> git tree: https://github.com/google/kmsan.git/master
> >> console output: https://syzkaller.appspot.com/x/log.txt?x=10556c92400000
> >> kernel config:
> >> https://syzkaller.appspot.com/x/.config?x=3431f03869413153
> >> dashboard link:
> >> https://syzkaller.appspot.com/bug?extid=194dffdb8b22fc5d207a
> >> compiler: clang version 8.0.0 (trunk 339414)
> >> syz repro:
> >> https://syzkaller.appspot.com/x/repro.syz?x=123a520a400000
> >> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16068dc1400000
>
> >> IMPORTANT: if you fix the bug, please add the following tag to the
> >> commit:
> >> Reported-by: syzbot+194dffdb8b22fc5d207a@syzkaller.appspotmail.com
>
> >> ==================================================================
> >> BUG: KMSAN: uninit-value in snd_midi_event_encode_byte+0x569/0xff0
> >> sound/core/seq/seq_midi_event.c:195
> >> CPU: 1 PID: 1659 Comm: kworker/1:1H Not tainted 4.19.0-rc1+ #40
> >> Hardware name: Google Google Compute Engine/Google Compute Engine,
> >> BIOS Google 01/01/2011
> >> Workqueue: events_highpri snd_vmidi_output_work
> >> Call Trace:
> >> __dump_stack lib/dump_stack.c:77 [inline]
> >> dump_stack+0x14b/0x190 lib/dump_stack.c:113
> >> kmsan_report+0x183/0x2b0 mm/kmsan/kmsan.c:956
> >> __msan_warning+0x70/0xc0 mm/kmsan/kmsan_instr.c:645
> >> snd_midi_event_encode_byte+0x569/0xff0
> >> sound/core/seq/seq_midi_event.c:195
> >> snd_vmidi_output_work+0x34e/0x5b0 sound/core/seq/seq_virmidi.c:161
> >> process_one_work+0x1605/0x1f40 kernel/workqueue.c:2153
> >> worker_thread+0x11a2/0x2590 kernel/workqueue.c:2296
> >> kthread+0x465/0x4a0 kernel/kthread.c:247
> >> ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:416
>
> >> Uninit was stored to memory at:
> >> kmsan_save_stack_with_flags mm/kmsan/kmsan.c:256 [inline]
> >> kmsan_save_stack mm/kmsan/kmsan.c:271 [inline]
> >> kmsan_internal_chain_origin+0x128/0x210 mm/kmsan/kmsan.c:573
> >> __msan_chain_origin+0x69/0xc0 mm/kmsan/kmsan_instr.c:482
> >> __snd_rawmidi_transmit_peek sound/core/rawmidi.c:1103 [inline]
> >> snd_rawmidi_transmit+0xa75/0xbf0 sound/core/rawmidi.c:1228
> >> snd_vmidi_output_work+0x2ac/0x5b0 sound/core/seq/seq_virmidi.c:159
> >> process_one_work+0x1605/0x1f40 kernel/workqueue.c:2153
> >> worker_thread+0x11a2/0x2590 kernel/workqueue.c:2296
> >> kthread+0x465/0x4a0 kernel/kthread.c:247
> >> ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:416
>
> >> Uninit was created at:
> >> kmsan_save_stack_with_flags mm/kmsan/kmsan.c:256 [inline]
> >> kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:181
> >> kmsan_kmalloc+0x98/0x100 mm/kmsan/kmsan_hooks.c:91
> >> __kmalloc_node+0x7bf/0x11c0 mm/slub.c:3828
> >> kmalloc_node include/linux/slab.h:555 [inline]
> >> kvmalloc_node+0x19d/0x3e0 mm/util.c:423
> >> kvmalloc include/linux/mm.h:577 [inline]
> >> snd_rawmidi_runtime_create sound/core/rawmidi.c:132 [inline]
> >> open_substream+0x3c8/0xaa0 sound/core/rawmidi.c:276
> >> rawmidi_open_priv+0x347/0x1000 sound/core/rawmidi.c:327
> >> snd_rawmidi_open+0x7d4/0x1120 sound/core/rawmidi.c:424
> >> soundcore_open+0x9be/0xa60 sound/sound_core.c:597
> >> chrdev_open+0xc26/0xdb0 fs/char_dev.c:417
> >> do_dentry_open+0xce6/0x1740 fs/open.c:771
> >> vfs_open+0xaf/0xe0 fs/open.c:880
> >> do_last fs/namei.c:3418 [inline]
> >> path_openat+0x1799/0x6870 fs/namei.c:3534
> >> do_filp_open+0x259/0x610 fs/namei.c:3564
> >> do_sys_open+0x630/0x940 fs/open.c:1063
> >> __do_sys_open fs/open.c:1081 [inline]
> >> __se_sys_open+0xad/0xc0 fs/open.c:1076
> >> __x64_sys_open+0x4a/0x70 fs/open.c:1076
> >> do_syscall_64+0xb8/0x100 arch/x86/entry/common.c:291
> >> entry_SYSCALL_64_after_hwframe+0x63/0xe7
> >> ==================================================================
>
> > This looks like some small race at virmidi reading and the buffer
> > handling, which should be almost harmless by itself.
> > Nevertheless, the fix should be easy, just replacing kvmalloc() with
> > kvzalloc(), as below.
>
> > Let's check whether this works.
>
> > #syz test:
> > git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git
> > topic/rawmidi-fixes
>
> KMSAN bugs can only be tested on https://github.com/google/kmsan.git tree
> because KMSAN tool is not upstreamed yet.
> See
> https://github.com/google/syzkaller/blob/master/docs/syzbot.md#kmsan-bugs
> for details.
So how is the procedure to test a patch for bugs spotted by KMSAN?
In this case, the fix is trivial, so I can put it to my tree for the
next pull request. Of course, it'd be better if it can be confirmed
to work beforehand...
thanks,
Takashi
>
>
>
> > Takashi
>
> > -- 8< --
> > From: Takashi Iwai <tiwai@suse.de>
> > Subject: [PATCH] ALSA: rawmidi: Initialize allocated buffers
>
> > syzbot reported the uninitialized value exposure in certain situations
> > using virmidi loop. It's likely a very small race at writing and
> > reading, and the influence is almost negligible. But it's safer to
> > paper over this just by replacing the existing kvmalloc() with
> > kvzalloc().
>
> > Reported-by: syzbot+194dffdb8b22fc5d207a@syzkaller.appspotmail.com
> > Signed-off-by: Takashi Iwai <tiwai@suse.de>
> > ---
> > sound/core/rawmidi.c | 4 ++--
> > 1 file changed, 2 insertions(+), 2 deletions(-)
>
> > diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
> > index 69517e18ef07..08d5662039e3 100644
> > --- a/sound/core/rawmidi.c
> > +++ b/sound/core/rawmidi.c
> > @@ -129,7 +129,7 @@ static int snd_rawmidi_runtime_create(struct
> > snd_rawmidi_substream *substream)
> > runtime->avail = 0;
> > else
> > runtime->avail = runtime->buffer_size;
> > - runtime->buffer = kvmalloc(runtime->buffer_size, GFP_KERNEL);
> > + runtime->buffer = kvzalloc(runtime->buffer_size, GFP_KERNEL);
> > if (!runtime->buffer) {
> > kfree(runtime);
> > return -ENOMEM;
> > @@ -655,7 +655,7 @@ static int resize_runtime_buffer(struct
> > snd_rawmidi_runtime *runtime,
> > if (params->avail_min < 1 || params->avail_min > params->buffer_size)
> > return -EINVAL;
> > if (params->buffer_size != runtime->buffer_size) {
> > - newbuf = kvmalloc(params->buffer_size, GFP_KERNEL);
> > + newbuf = kvzalloc(params->buffer_size, GFP_KERNEL);
> > if (!newbuf)
> > return -ENOMEM;
> > spin_lock_irq(&runtime->lock);
> > --
> > 2.18.0
>
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: KMSAN: uninit-value in snd_midi_event_encode_byte
2018-09-03 13:29 ` Takashi Iwai
@ 2018-09-03 13:33 ` Dmitry Vyukov
2018-09-03 13:37 ` Takashi Iwai
0 siblings, 1 reply; 17+ messages in thread
From: Dmitry Vyukov @ 2018-09-03 13:33 UTC (permalink / raw)
To: Takashi Iwai
Cc: syzbot, alsa-devel-bounces, alsa-devel, LKML, Jaroslav Kysela,
syzkaller-bugs
On Mon, Sep 3, 2018 at 3:29 PM, Takashi Iwai <tiwai@suse.de> wrote:
> On Mon, 03 Sep 2018 15:22:42 +0200,
> syzbot wrote:
>>
>> > On Mon, 03 Sep 2018 03:53:03 +0200,
>> > syzbot wrote:
>>
>> >> syzbot has found a reproducer for the following crash on:
>>
>> >> HEAD commit: 28f0ca98eadf kmsan: don't instrument
>> >> do_syscall_64() and _..
>> >> git tree: https://github.com/google/kmsan.git/master
>> >> console output: https://syzkaller.appspot.com/x/log.txt?x=10556c92400000
>> >> kernel config:
>> >> https://syzkaller.appspot.com/x/.config?x=3431f03869413153
>> >> dashboard link:
>> >> https://syzkaller.appspot.com/bug?extid=194dffdb8b22fc5d207a
>> >> compiler: clang version 8.0.0 (trunk 339414)
>> >> syz repro:
>> >> https://syzkaller.appspot.com/x/repro.syz?x=123a520a400000
>> >> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16068dc1400000
>>
>> >> IMPORTANT: if you fix the bug, please add the following tag to the
>> >> commit:
>> >> Reported-by: syzbot+194dffdb8b22fc5d207a@syzkaller.appspotmail.com
>>
>> >> ==================================================================
>> >> BUG: KMSAN: uninit-value in snd_midi_event_encode_byte+0x569/0xff0
>> >> sound/core/seq/seq_midi_event.c:195
>> >> CPU: 1 PID: 1659 Comm: kworker/1:1H Not tainted 4.19.0-rc1+ #40
>> >> Hardware name: Google Google Compute Engine/Google Compute Engine,
>> >> BIOS Google 01/01/2011
>> >> Workqueue: events_highpri snd_vmidi_output_work
>> >> Call Trace:
>> >> __dump_stack lib/dump_stack.c:77 [inline]
>> >> dump_stack+0x14b/0x190 lib/dump_stack.c:113
>> >> kmsan_report+0x183/0x2b0 mm/kmsan/kmsan.c:956
>> >> __msan_warning+0x70/0xc0 mm/kmsan/kmsan_instr.c:645
>> >> snd_midi_event_encode_byte+0x569/0xff0
>> >> sound/core/seq/seq_midi_event.c:195
>> >> snd_vmidi_output_work+0x34e/0x5b0 sound/core/seq/seq_virmidi.c:161
>> >> process_one_work+0x1605/0x1f40 kernel/workqueue.c:2153
>> >> worker_thread+0x11a2/0x2590 kernel/workqueue.c:2296
>> >> kthread+0x465/0x4a0 kernel/kthread.c:247
>> >> ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:416
>>
>> >> Uninit was stored to memory at:
>> >> kmsan_save_stack_with_flags mm/kmsan/kmsan.c:256 [inline]
>> >> kmsan_save_stack mm/kmsan/kmsan.c:271 [inline]
>> >> kmsan_internal_chain_origin+0x128/0x210 mm/kmsan/kmsan.c:573
>> >> __msan_chain_origin+0x69/0xc0 mm/kmsan/kmsan_instr.c:482
>> >> __snd_rawmidi_transmit_peek sound/core/rawmidi.c:1103 [inline]
>> >> snd_rawmidi_transmit+0xa75/0xbf0 sound/core/rawmidi.c:1228
>> >> snd_vmidi_output_work+0x2ac/0x5b0 sound/core/seq/seq_virmidi.c:159
>> >> process_one_work+0x1605/0x1f40 kernel/workqueue.c:2153
>> >> worker_thread+0x11a2/0x2590 kernel/workqueue.c:2296
>> >> kthread+0x465/0x4a0 kernel/kthread.c:247
>> >> ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:416
>>
>> >> Uninit was created at:
>> >> kmsan_save_stack_with_flags mm/kmsan/kmsan.c:256 [inline]
>> >> kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:181
>> >> kmsan_kmalloc+0x98/0x100 mm/kmsan/kmsan_hooks.c:91
>> >> __kmalloc_node+0x7bf/0x11c0 mm/slub.c:3828
>> >> kmalloc_node include/linux/slab.h:555 [inline]
>> >> kvmalloc_node+0x19d/0x3e0 mm/util.c:423
>> >> kvmalloc include/linux/mm.h:577 [inline]
>> >> snd_rawmidi_runtime_create sound/core/rawmidi.c:132 [inline]
>> >> open_substream+0x3c8/0xaa0 sound/core/rawmidi.c:276
>> >> rawmidi_open_priv+0x347/0x1000 sound/core/rawmidi.c:327
>> >> snd_rawmidi_open+0x7d4/0x1120 sound/core/rawmidi.c:424
>> >> soundcore_open+0x9be/0xa60 sound/sound_core.c:597
>> >> chrdev_open+0xc26/0xdb0 fs/char_dev.c:417
>> >> do_dentry_open+0xce6/0x1740 fs/open.c:771
>> >> vfs_open+0xaf/0xe0 fs/open.c:880
>> >> do_last fs/namei.c:3418 [inline]
>> >> path_openat+0x1799/0x6870 fs/namei.c:3534
>> >> do_filp_open+0x259/0x610 fs/namei.c:3564
>> >> do_sys_open+0x630/0x940 fs/open.c:1063
>> >> __do_sys_open fs/open.c:1081 [inline]
>> >> __se_sys_open+0xad/0xc0 fs/open.c:1076
>> >> __x64_sys_open+0x4a/0x70 fs/open.c:1076
>> >> do_syscall_64+0xb8/0x100 arch/x86/entry/common.c:291
>> >> entry_SYSCALL_64_after_hwframe+0x63/0xe7
>> >> ==================================================================
>>
>> > This looks like some small race at virmidi reading and the buffer
>> > handling, which should be almost harmless by itself.
>> > Nevertheless, the fix should be easy, just replacing kvmalloc() with
>> > kvzalloc(), as below.
>>
>> > Let's check whether this works.
>>
>> > #syz test:
>> > git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git
>> > topic/rawmidi-fixes
>>
>> KMSAN bugs can only be tested on https://github.com/google/kmsan.git tree
>> because KMSAN tool is not upstreamed yet.
>> See
>> https://github.com/google/syzkaller/blob/master/docs/syzbot.md#kmsan-bugs
>> for details.
>
> So how is the procedure to test a patch for bugs spotted by KMSAN?
>
> In this case, the fix is trivial, so I can put it to my tree for the
> next pull request. Of course, it'd be better if it can be confirmed
> to work beforehand...
https://github.com/google/syzkaller/blob/master/docs/syzbot.md#kmsan-bugs
Which means you need to attach a patch because it's not in that tree.
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: KMSAN: uninit-value in snd_midi_event_encode_byte
2018-09-03 13:33 ` Dmitry Vyukov
@ 2018-09-03 13:37 ` Takashi Iwai
2018-09-03 13:41 ` Dmitry Vyukov
0 siblings, 1 reply; 17+ messages in thread
From: Takashi Iwai @ 2018-09-03 13:37 UTC (permalink / raw)
To: Dmitry Vyukov
Cc: syzbot, alsa-devel-bounces, alsa-devel, LKML, Jaroslav Kysela,
syzkaller-bugs
On Mon, 03 Sep 2018 15:33:12 +0200,
Dmitry Vyukov wrote:
>
> On Mon, Sep 3, 2018 at 3:29 PM, Takashi Iwai <tiwai@suse.de> wrote:
> > On Mon, 03 Sep 2018 15:22:42 +0200,
> > syzbot wrote:
> >>
> >> > On Mon, 03 Sep 2018 03:53:03 +0200,
> >> > syzbot wrote:
> >>
> >> >> syzbot has found a reproducer for the following crash on:
> >>
> >> >> HEAD commit: 28f0ca98eadf kmsan: don't instrument
> >> >> do_syscall_64() and _..
> >> >> git tree: https://github.com/google/kmsan.git/master
> >> >> console output: https://syzkaller.appspot.com/x/log.txt?x=10556c92400000
> >> >> kernel config:
> >> >> https://syzkaller.appspot.com/x/.config?x=3431f03869413153
> >> >> dashboard link:
> >> >> https://syzkaller.appspot.com/bug?extid=194dffdb8b22fc5d207a
> >> >> compiler: clang version 8.0.0 (trunk 339414)
> >> >> syz repro:
> >> >> https://syzkaller.appspot.com/x/repro.syz?x=123a520a400000
> >> >> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16068dc1400000
> >>
> >> >> IMPORTANT: if you fix the bug, please add the following tag to the
> >> >> commit:
> >> >> Reported-by: syzbot+194dffdb8b22fc5d207a@syzkaller.appspotmail.com
> >>
> >> >> ==================================================================
> >> >> BUG: KMSAN: uninit-value in snd_midi_event_encode_byte+0x569/0xff0
> >> >> sound/core/seq/seq_midi_event.c:195
> >> >> CPU: 1 PID: 1659 Comm: kworker/1:1H Not tainted 4.19.0-rc1+ #40
> >> >> Hardware name: Google Google Compute Engine/Google Compute Engine,
> >> >> BIOS Google 01/01/2011
> >> >> Workqueue: events_highpri snd_vmidi_output_work
> >> >> Call Trace:
> >> >> __dump_stack lib/dump_stack.c:77 [inline]
> >> >> dump_stack+0x14b/0x190 lib/dump_stack.c:113
> >> >> kmsan_report+0x183/0x2b0 mm/kmsan/kmsan.c:956
> >> >> __msan_warning+0x70/0xc0 mm/kmsan/kmsan_instr.c:645
> >> >> snd_midi_event_encode_byte+0x569/0xff0
> >> >> sound/core/seq/seq_midi_event.c:195
> >> >> snd_vmidi_output_work+0x34e/0x5b0 sound/core/seq/seq_virmidi.c:161
> >> >> process_one_work+0x1605/0x1f40 kernel/workqueue.c:2153
> >> >> worker_thread+0x11a2/0x2590 kernel/workqueue.c:2296
> >> >> kthread+0x465/0x4a0 kernel/kthread.c:247
> >> >> ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:416
> >>
> >> >> Uninit was stored to memory at:
> >> >> kmsan_save_stack_with_flags mm/kmsan/kmsan.c:256 [inline]
> >> >> kmsan_save_stack mm/kmsan/kmsan.c:271 [inline]
> >> >> kmsan_internal_chain_origin+0x128/0x210 mm/kmsan/kmsan.c:573
> >> >> __msan_chain_origin+0x69/0xc0 mm/kmsan/kmsan_instr.c:482
> >> >> __snd_rawmidi_transmit_peek sound/core/rawmidi.c:1103 [inline]
> >> >> snd_rawmidi_transmit+0xa75/0xbf0 sound/core/rawmidi.c:1228
> >> >> snd_vmidi_output_work+0x2ac/0x5b0 sound/core/seq/seq_virmidi.c:159
> >> >> process_one_work+0x1605/0x1f40 kernel/workqueue.c:2153
> >> >> worker_thread+0x11a2/0x2590 kernel/workqueue.c:2296
> >> >> kthread+0x465/0x4a0 kernel/kthread.c:247
> >> >> ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:416
> >>
> >> >> Uninit was created at:
> >> >> kmsan_save_stack_with_flags mm/kmsan/kmsan.c:256 [inline]
> >> >> kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:181
> >> >> kmsan_kmalloc+0x98/0x100 mm/kmsan/kmsan_hooks.c:91
> >> >> __kmalloc_node+0x7bf/0x11c0 mm/slub.c:3828
> >> >> kmalloc_node include/linux/slab.h:555 [inline]
> >> >> kvmalloc_node+0x19d/0x3e0 mm/util.c:423
> >> >> kvmalloc include/linux/mm.h:577 [inline]
> >> >> snd_rawmidi_runtime_create sound/core/rawmidi.c:132 [inline]
> >> >> open_substream+0x3c8/0xaa0 sound/core/rawmidi.c:276
> >> >> rawmidi_open_priv+0x347/0x1000 sound/core/rawmidi.c:327
> >> >> snd_rawmidi_open+0x7d4/0x1120 sound/core/rawmidi.c:424
> >> >> soundcore_open+0x9be/0xa60 sound/sound_core.c:597
> >> >> chrdev_open+0xc26/0xdb0 fs/char_dev.c:417
> >> >> do_dentry_open+0xce6/0x1740 fs/open.c:771
> >> >> vfs_open+0xaf/0xe0 fs/open.c:880
> >> >> do_last fs/namei.c:3418 [inline]
> >> >> path_openat+0x1799/0x6870 fs/namei.c:3534
> >> >> do_filp_open+0x259/0x610 fs/namei.c:3564
> >> >> do_sys_open+0x630/0x940 fs/open.c:1063
> >> >> __do_sys_open fs/open.c:1081 [inline]
> >> >> __se_sys_open+0xad/0xc0 fs/open.c:1076
> >> >> __x64_sys_open+0x4a/0x70 fs/open.c:1076
> >> >> do_syscall_64+0xb8/0x100 arch/x86/entry/common.c:291
> >> >> entry_SYSCALL_64_after_hwframe+0x63/0xe7
> >> >> ==================================================================
> >>
> >> > This looks like some small race at virmidi reading and the buffer
> >> > handling, which should be almost harmless by itself.
> >> > Nevertheless, the fix should be easy, just replacing kvmalloc() with
> >> > kvzalloc(), as below.
> >>
> >> > Let's check whether this works.
> >>
> >> > #syz test:
> >> > git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git
> >> > topic/rawmidi-fixes
> >>
> >> KMSAN bugs can only be tested on https://github.com/google/kmsan.git tree
> >> because KMSAN tool is not upstreamed yet.
> >> See
> >> https://github.com/google/syzkaller/blob/master/docs/syzbot.md#kmsan-bugs
> >> for details.
> >
> > So how is the procedure to test a patch for bugs spotted by KMSAN?
> >
> > In this case, the fix is trivial, so I can put it to my tree for the
> > next pull request. Of course, it'd be better if it can be confirmed
> > to work beforehand...
>
> https://github.com/google/syzkaller/blob/master/docs/syzbot.md#kmsan-bugs
>
> Which means you need to attach a patch because it's not in that tree.
OK, it would have been helpful if the description there was more clear
:)
And no automated way for that? I mean, I already attached patch in
the previous reply (together with syz-magic command to point the git
branch URL). Do I need anything else?
thanks,
Takashi
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: KMSAN: uninit-value in snd_midi_event_encode_byte
2018-09-03 13:37 ` Takashi Iwai
@ 2018-09-03 13:41 ` Dmitry Vyukov
2018-09-03 14:04 ` Takashi Iwai
0 siblings, 1 reply; 17+ messages in thread
From: Dmitry Vyukov @ 2018-09-03 13:41 UTC (permalink / raw)
To: Takashi Iwai
Cc: syzbot, alsa-devel-bounces, alsa-devel, LKML, Jaroslav Kysela,
syzkaller-bugs
On Mon, Sep 3, 2018 at 3:37 PM, Takashi Iwai <tiwai@suse.de> wrote:
> On Mon, 03 Sep 2018 15:33:12 +0200,
> Dmitry Vyukov wrote:
>>
>> On Mon, Sep 3, 2018 at 3:29 PM, Takashi Iwai <tiwai@suse.de> wrote:
>> > On Mon, 03 Sep 2018 15:22:42 +0200,
>> > syzbot wrote:
>> >>
>> >> > On Mon, 03 Sep 2018 03:53:03 +0200,
>> >> > syzbot wrote:
>> >>
>> >> >> syzbot has found a reproducer for the following crash on:
>> >>
>> >> >> HEAD commit: 28f0ca98eadf kmsan: don't instrument
>> >> >> do_syscall_64() and _..
>> >> >> git tree: https://github.com/google/kmsan.git/master
>> >> >> console output: https://syzkaller.appspot.com/x/log.txt?x=10556c92400000
>> >> >> kernel config:
>> >> >> https://syzkaller.appspot.com/x/.config?x=3431f03869413153
>> >> >> dashboard link:
>> >> >> https://syzkaller.appspot.com/bug?extid=194dffdb8b22fc5d207a
>> >> >> compiler: clang version 8.0.0 (trunk 339414)
>> >> >> syz repro:
>> >> >> https://syzkaller.appspot.com/x/repro.syz?x=123a520a400000
>> >> >> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16068dc1400000
>> >>
>> >> >> IMPORTANT: if you fix the bug, please add the following tag to the
>> >> >> commit:
>> >> >> Reported-by: syzbot+194dffdb8b22fc5d207a@syzkaller.appspotmail.com
>> >>
>> >> >> ==================================================================
>> >> >> BUG: KMSAN: uninit-value in snd_midi_event_encode_byte+0x569/0xff0
>> >> >> sound/core/seq/seq_midi_event.c:195
>> >> >> CPU: 1 PID: 1659 Comm: kworker/1:1H Not tainted 4.19.0-rc1+ #40
>> >> >> Hardware name: Google Google Compute Engine/Google Compute Engine,
>> >> >> BIOS Google 01/01/2011
>> >> >> Workqueue: events_highpri snd_vmidi_output_work
>> >> >> Call Trace:
>> >> >> __dump_stack lib/dump_stack.c:77 [inline]
>> >> >> dump_stack+0x14b/0x190 lib/dump_stack.c:113
>> >> >> kmsan_report+0x183/0x2b0 mm/kmsan/kmsan.c:956
>> >> >> __msan_warning+0x70/0xc0 mm/kmsan/kmsan_instr.c:645
>> >> >> snd_midi_event_encode_byte+0x569/0xff0
>> >> >> sound/core/seq/seq_midi_event.c:195
>> >> >> snd_vmidi_output_work+0x34e/0x5b0 sound/core/seq/seq_virmidi.c:161
>> >> >> process_one_work+0x1605/0x1f40 kernel/workqueue.c:2153
>> >> >> worker_thread+0x11a2/0x2590 kernel/workqueue.c:2296
>> >> >> kthread+0x465/0x4a0 kernel/kthread.c:247
>> >> >> ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:416
>> >>
>> >> >> Uninit was stored to memory at:
>> >> >> kmsan_save_stack_with_flags mm/kmsan/kmsan.c:256 [inline]
>> >> >> kmsan_save_stack mm/kmsan/kmsan.c:271 [inline]
>> >> >> kmsan_internal_chain_origin+0x128/0x210 mm/kmsan/kmsan.c:573
>> >> >> __msan_chain_origin+0x69/0xc0 mm/kmsan/kmsan_instr.c:482
>> >> >> __snd_rawmidi_transmit_peek sound/core/rawmidi.c:1103 [inline]
>> >> >> snd_rawmidi_transmit+0xa75/0xbf0 sound/core/rawmidi.c:1228
>> >> >> snd_vmidi_output_work+0x2ac/0x5b0 sound/core/seq/seq_virmidi.c:159
>> >> >> process_one_work+0x1605/0x1f40 kernel/workqueue.c:2153
>> >> >> worker_thread+0x11a2/0x2590 kernel/workqueue.c:2296
>> >> >> kthread+0x465/0x4a0 kernel/kthread.c:247
>> >> >> ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:416
>> >>
>> >> >> Uninit was created at:
>> >> >> kmsan_save_stack_with_flags mm/kmsan/kmsan.c:256 [inline]
>> >> >> kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:181
>> >> >> kmsan_kmalloc+0x98/0x100 mm/kmsan/kmsan_hooks.c:91
>> >> >> __kmalloc_node+0x7bf/0x11c0 mm/slub.c:3828
>> >> >> kmalloc_node include/linux/slab.h:555 [inline]
>> >> >> kvmalloc_node+0x19d/0x3e0 mm/util.c:423
>> >> >> kvmalloc include/linux/mm.h:577 [inline]
>> >> >> snd_rawmidi_runtime_create sound/core/rawmidi.c:132 [inline]
>> >> >> open_substream+0x3c8/0xaa0 sound/core/rawmidi.c:276
>> >> >> rawmidi_open_priv+0x347/0x1000 sound/core/rawmidi.c:327
>> >> >> snd_rawmidi_open+0x7d4/0x1120 sound/core/rawmidi.c:424
>> >> >> soundcore_open+0x9be/0xa60 sound/sound_core.c:597
>> >> >> chrdev_open+0xc26/0xdb0 fs/char_dev.c:417
>> >> >> do_dentry_open+0xce6/0x1740 fs/open.c:771
>> >> >> vfs_open+0xaf/0xe0 fs/open.c:880
>> >> >> do_last fs/namei.c:3418 [inline]
>> >> >> path_openat+0x1799/0x6870 fs/namei.c:3534
>> >> >> do_filp_open+0x259/0x610 fs/namei.c:3564
>> >> >> do_sys_open+0x630/0x940 fs/open.c:1063
>> >> >> __do_sys_open fs/open.c:1081 [inline]
>> >> >> __se_sys_open+0xad/0xc0 fs/open.c:1076
>> >> >> __x64_sys_open+0x4a/0x70 fs/open.c:1076
>> >> >> do_syscall_64+0xb8/0x100 arch/x86/entry/common.c:291
>> >> >> entry_SYSCALL_64_after_hwframe+0x63/0xe7
>> >> >> ==================================================================
>> >>
>> >> > This looks like some small race at virmidi reading and the buffer
>> >> > handling, which should be almost harmless by itself.
>> >> > Nevertheless, the fix should be easy, just replacing kvmalloc() with
>> >> > kvzalloc(), as below.
>> >>
>> >> > Let's check whether this works.
>> >>
>> >> > #syz test:
>> >> > git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git
>> >> > topic/rawmidi-fixes
>> >>
>> >> KMSAN bugs can only be tested on https://github.com/google/kmsan.git tree
>> >> because KMSAN tool is not upstreamed yet.
>> >> See
>> >> https://github.com/google/syzkaller/blob/master/docs/syzbot.md#kmsan-bugs
>> >> for details.
>> >
>> > So how is the procedure to test a patch for bugs spotted by KMSAN?
>> >
>> > In this case, the fix is trivial, so I can put it to my tree for the
>> > next pull request. Of course, it'd be better if it can be confirmed
>> > to work beforehand...
>>
>> https://github.com/google/syzkaller/blob/master/docs/syzbot.md#kmsan-bugs
>>
>> Which means you need to attach a patch because it's not in that tree.
>
> OK, it would have been helpful if the description there was more clear
> :)
>
> And no automated way for that?
What exactly do you mean? Please elaborate.
> I mean, I already attached patch in
> the previous reply (together with syz-magic command to point the git
> branch URL). Do I need anything else?
Just issue the command against "https://github.com/google/kmsan.git
master" and attach the patch.
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: KMSAN: uninit-value in snd_midi_event_encode_byte
2018-09-03 13:41 ` Dmitry Vyukov
@ 2018-09-03 14:04 ` Takashi Iwai
2018-09-03 14:19 ` Dmitry Vyukov
0 siblings, 1 reply; 17+ messages in thread
From: Takashi Iwai @ 2018-09-03 14:04 UTC (permalink / raw)
To: Dmitry Vyukov
Cc: syzbot, alsa-devel-bounces, alsa-devel, LKML, Jaroslav Kysela,
syzkaller-bugs
On Mon, 03 Sep 2018 15:41:36 +0200,
Dmitry Vyukov wrote:
>
> On Mon, Sep 3, 2018 at 3:37 PM, Takashi Iwai <tiwai@suse.de> wrote:
> > On Mon, 03 Sep 2018 15:33:12 +0200,
> > Dmitry Vyukov wrote:
> >>
> >> On Mon, Sep 3, 2018 at 3:29 PM, Takashi Iwai <tiwai@suse.de> wrote:
> >> > On Mon, 03 Sep 2018 15:22:42 +0200,
> >> > syzbot wrote:
> >> >>
> >> >> > On Mon, 03 Sep 2018 03:53:03 +0200,
> >> >> > syzbot wrote:
> >> >>
> >> >> >> syzbot has found a reproducer for the following crash on:
> >> >>
> >> >> >> HEAD commit: 28f0ca98eadf kmsan: don't instrument
> >> >> >> do_syscall_64() and _..
> >> >> >> git tree: https://github.com/google/kmsan.git/master
> >> >> >> console output: https://syzkaller.appspot.com/x/log.txt?x=10556c92400000
> >> >> >> kernel config:
> >> >> >> https://syzkaller.appspot.com/x/.config?x=3431f03869413153
> >> >> >> dashboard link:
> >> >> >> https://syzkaller.appspot.com/bug?extid=194dffdb8b22fc5d207a
> >> >> >> compiler: clang version 8.0.0 (trunk 339414)
> >> >> >> syz repro:
> >> >> >> https://syzkaller.appspot.com/x/repro.syz?x=123a520a400000
> >> >> >> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16068dc1400000
> >> >>
> >> >> >> IMPORTANT: if you fix the bug, please add the following tag to the
> >> >> >> commit:
> >> >> >> Reported-by: syzbot+194dffdb8b22fc5d207a@syzkaller.appspotmail.com
> >> >>
> >> >> >> ==================================================================
> >> >> >> BUG: KMSAN: uninit-value in snd_midi_event_encode_byte+0x569/0xff0
> >> >> >> sound/core/seq/seq_midi_event.c:195
> >> >> >> CPU: 1 PID: 1659 Comm: kworker/1:1H Not tainted 4.19.0-rc1+ #40
> >> >> >> Hardware name: Google Google Compute Engine/Google Compute Engine,
> >> >> >> BIOS Google 01/01/2011
> >> >> >> Workqueue: events_highpri snd_vmidi_output_work
> >> >> >> Call Trace:
> >> >> >> __dump_stack lib/dump_stack.c:77 [inline]
> >> >> >> dump_stack+0x14b/0x190 lib/dump_stack.c:113
> >> >> >> kmsan_report+0x183/0x2b0 mm/kmsan/kmsan.c:956
> >> >> >> __msan_warning+0x70/0xc0 mm/kmsan/kmsan_instr.c:645
> >> >> >> snd_midi_event_encode_byte+0x569/0xff0
> >> >> >> sound/core/seq/seq_midi_event.c:195
> >> >> >> snd_vmidi_output_work+0x34e/0x5b0 sound/core/seq/seq_virmidi.c:161
> >> >> >> process_one_work+0x1605/0x1f40 kernel/workqueue.c:2153
> >> >> >> worker_thread+0x11a2/0x2590 kernel/workqueue.c:2296
> >> >> >> kthread+0x465/0x4a0 kernel/kthread.c:247
> >> >> >> ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:416
> >> >>
> >> >> >> Uninit was stored to memory at:
> >> >> >> kmsan_save_stack_with_flags mm/kmsan/kmsan.c:256 [inline]
> >> >> >> kmsan_save_stack mm/kmsan/kmsan.c:271 [inline]
> >> >> >> kmsan_internal_chain_origin+0x128/0x210 mm/kmsan/kmsan.c:573
> >> >> >> __msan_chain_origin+0x69/0xc0 mm/kmsan/kmsan_instr.c:482
> >> >> >> __snd_rawmidi_transmit_peek sound/core/rawmidi.c:1103 [inline]
> >> >> >> snd_rawmidi_transmit+0xa75/0xbf0 sound/core/rawmidi.c:1228
> >> >> >> snd_vmidi_output_work+0x2ac/0x5b0 sound/core/seq/seq_virmidi.c:159
> >> >> >> process_one_work+0x1605/0x1f40 kernel/workqueue.c:2153
> >> >> >> worker_thread+0x11a2/0x2590 kernel/workqueue.c:2296
> >> >> >> kthread+0x465/0x4a0 kernel/kthread.c:247
> >> >> >> ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:416
> >> >>
> >> >> >> Uninit was created at:
> >> >> >> kmsan_save_stack_with_flags mm/kmsan/kmsan.c:256 [inline]
> >> >> >> kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:181
> >> >> >> kmsan_kmalloc+0x98/0x100 mm/kmsan/kmsan_hooks.c:91
> >> >> >> __kmalloc_node+0x7bf/0x11c0 mm/slub.c:3828
> >> >> >> kmalloc_node include/linux/slab.h:555 [inline]
> >> >> >> kvmalloc_node+0x19d/0x3e0 mm/util.c:423
> >> >> >> kvmalloc include/linux/mm.h:577 [inline]
> >> >> >> snd_rawmidi_runtime_create sound/core/rawmidi.c:132 [inline]
> >> >> >> open_substream+0x3c8/0xaa0 sound/core/rawmidi.c:276
> >> >> >> rawmidi_open_priv+0x347/0x1000 sound/core/rawmidi.c:327
> >> >> >> snd_rawmidi_open+0x7d4/0x1120 sound/core/rawmidi.c:424
> >> >> >> soundcore_open+0x9be/0xa60 sound/sound_core.c:597
> >> >> >> chrdev_open+0xc26/0xdb0 fs/char_dev.c:417
> >> >> >> do_dentry_open+0xce6/0x1740 fs/open.c:771
> >> >> >> vfs_open+0xaf/0xe0 fs/open.c:880
> >> >> >> do_last fs/namei.c:3418 [inline]
> >> >> >> path_openat+0x1799/0x6870 fs/namei.c:3534
> >> >> >> do_filp_open+0x259/0x610 fs/namei.c:3564
> >> >> >> do_sys_open+0x630/0x940 fs/open.c:1063
> >> >> >> __do_sys_open fs/open.c:1081 [inline]
> >> >> >> __se_sys_open+0xad/0xc0 fs/open.c:1076
> >> >> >> __x64_sys_open+0x4a/0x70 fs/open.c:1076
> >> >> >> do_syscall_64+0xb8/0x100 arch/x86/entry/common.c:291
> >> >> >> entry_SYSCALL_64_after_hwframe+0x63/0xe7
> >> >> >> ==================================================================
> >> >>
> >> >> > This looks like some small race at virmidi reading and the buffer
> >> >> > handling, which should be almost harmless by itself.
> >> >> > Nevertheless, the fix should be easy, just replacing kvmalloc() with
> >> >> > kvzalloc(), as below.
> >> >>
> >> >> > Let's check whether this works.
> >> >>
> >> >> > #syz test:
> >> >> > git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git
> >> >> > topic/rawmidi-fixes
> >> >>
> >> >> KMSAN bugs can only be tested on https://github.com/google/kmsan.git tree
> >> >> because KMSAN tool is not upstreamed yet.
> >> >> See
> >> >> https://github.com/google/syzkaller/blob/master/docs/syzbot.md#kmsan-bugs
> >> >> for details.
> >> >
> >> > So how is the procedure to test a patch for bugs spotted by KMSAN?
> >> >
> >> > In this case, the fix is trivial, so I can put it to my tree for the
> >> > next pull request. Of course, it'd be better if it can be confirmed
> >> > to work beforehand...
> >>
> >> https://github.com/google/syzkaller/blob/master/docs/syzbot.md#kmsan-bugs
> >>
> >> Which means you need to attach a patch because it's not in that tree.
> >
> > OK, it would have been helpful if the description there was more clear
> > :)
> >
> > And no automated way for that?
>
> What exactly do you mean? Please elaborate.
Well, it's not clear which action is required to let syzbot testing
some patch. The description says:
"KMSAN is not upstream yet, though, we want to upstream it later. For
now, it lives in github.com/google/kmsan and is based on a
reasonably fresh upstream tree. As the result, any patch testing
requests for KMSAN bugs need to go to KMSAN tree
(https://github.com/google/kmsan.git repo, master branch)."
Here, "need to go to KMSAN tree" part doesn't explain what exactly to
do. Remember that many kernel devs (including the man in the mirror)
don't use github, at least, not dealing github PRs for kernel
development itself, so it's a pretty unfamiliar process.
> > I mean, I already attached patch in
> > the previous reply (together with syz-magic command to point the git
> > branch URL). Do I need anything else?
>
> Just issue the command against "https://github.com/google/kmsan.git
> master" and attach the patch.
But it's basically a fix for the upstream tree, not about KMSAN
itself. A PR to that tree doesn't sound right to me...
thanks,
Takashi
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: KMSAN: uninit-value in snd_midi_event_encode_byte
2018-09-03 14:04 ` Takashi Iwai
@ 2018-09-03 14:19 ` Dmitry Vyukov
2018-09-03 14:30 ` Takashi Iwai
0 siblings, 1 reply; 17+ messages in thread
From: Dmitry Vyukov @ 2018-09-03 14:19 UTC (permalink / raw)
To: Takashi Iwai
Cc: syzbot, alsa-devel-bounces, alsa-devel, LKML, Jaroslav Kysela,
syzkaller-bugs
On Mon, Sep 3, 2018 at 4:04 PM, Takashi Iwai <tiwai@suse.de> wrote:
> On Mon, 03 Sep 2018 15:41:36 +0200,
> Dmitry Vyukov wrote:
>>
>> On Mon, Sep 3, 2018 at 3:37 PM, Takashi Iwai <tiwai@suse.de> wrote:
>> > On Mon, 03 Sep 2018 15:33:12 +0200,
>> > Dmitry Vyukov wrote:
>> >>
>> >> On Mon, Sep 3, 2018 at 3:29 PM, Takashi Iwai <tiwai@suse.de> wrote:
>> >> > On Mon, 03 Sep 2018 15:22:42 +0200,
>> >> > syzbot wrote:
>> >> >>
>> >> >> > On Mon, 03 Sep 2018 03:53:03 +0200,
>> >> >> > syzbot wrote:
>> >> >>
>> >> >> >> syzbot has found a reproducer for the following crash on:
>> >> >>
>> >> >> >> HEAD commit: 28f0ca98eadf kmsan: don't instrument
>> >> >> >> do_syscall_64() and _..
>> >> >> >> git tree: https://github.com/google/kmsan.git/master
>> >> >> >> console output: https://syzkaller.appspot.com/x/log.txt?x=10556c92400000
>> >> >> >> kernel config:
>> >> >> >> https://syzkaller.appspot.com/x/.config?x=3431f03869413153
>> >> >> >> dashboard link:
>> >> >> >> https://syzkaller.appspot.com/bug?extid=194dffdb8b22fc5d207a
>> >> >> >> compiler: clang version 8.0.0 (trunk 339414)
>> >> >> >> syz repro:
>> >> >> >> https://syzkaller.appspot.com/x/repro.syz?x=123a520a400000
>> >> >> >> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16068dc1400000
>> >> >>
>> >> >> >> IMPORTANT: if you fix the bug, please add the following tag to the
>> >> >> >> commit:
>> >> >> >> Reported-by: syzbot+194dffdb8b22fc5d207a@syzkaller.appspotmail.com
>> >> >>
>> >> >> >> ==================================================================
>> >> >> >> BUG: KMSAN: uninit-value in snd_midi_event_encode_byte+0x569/0xff0
>> >> >> >> sound/core/seq/seq_midi_event.c:195
>> >> >> >> CPU: 1 PID: 1659 Comm: kworker/1:1H Not tainted 4.19.0-rc1+ #40
>> >> >> >> Hardware name: Google Google Compute Engine/Google Compute Engine,
>> >> >> >> BIOS Google 01/01/2011
>> >> >> >> Workqueue: events_highpri snd_vmidi_output_work
>> >> >> >> Call Trace:
>> >> >> >> __dump_stack lib/dump_stack.c:77 [inline]
>> >> >> >> dump_stack+0x14b/0x190 lib/dump_stack.c:113
>> >> >> >> kmsan_report+0x183/0x2b0 mm/kmsan/kmsan.c:956
>> >> >> >> __msan_warning+0x70/0xc0 mm/kmsan/kmsan_instr.c:645
>> >> >> >> snd_midi_event_encode_byte+0x569/0xff0
>> >> >> >> sound/core/seq/seq_midi_event.c:195
>> >> >> >> snd_vmidi_output_work+0x34e/0x5b0 sound/core/seq/seq_virmidi.c:161
>> >> >> >> process_one_work+0x1605/0x1f40 kernel/workqueue.c:2153
>> >> >> >> worker_thread+0x11a2/0x2590 kernel/workqueue.c:2296
>> >> >> >> kthread+0x465/0x4a0 kernel/kthread.c:247
>> >> >> >> ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:416
>> >> >>
>> >> >> >> Uninit was stored to memory at:
>> >> >> >> kmsan_save_stack_with_flags mm/kmsan/kmsan.c:256 [inline]
>> >> >> >> kmsan_save_stack mm/kmsan/kmsan.c:271 [inline]
>> >> >> >> kmsan_internal_chain_origin+0x128/0x210 mm/kmsan/kmsan.c:573
>> >> >> >> __msan_chain_origin+0x69/0xc0 mm/kmsan/kmsan_instr.c:482
>> >> >> >> __snd_rawmidi_transmit_peek sound/core/rawmidi.c:1103 [inline]
>> >> >> >> snd_rawmidi_transmit+0xa75/0xbf0 sound/core/rawmidi.c:1228
>> >> >> >> snd_vmidi_output_work+0x2ac/0x5b0 sound/core/seq/seq_virmidi.c:159
>> >> >> >> process_one_work+0x1605/0x1f40 kernel/workqueue.c:2153
>> >> >> >> worker_thread+0x11a2/0x2590 kernel/workqueue.c:2296
>> >> >> >> kthread+0x465/0x4a0 kernel/kthread.c:247
>> >> >> >> ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:416
>> >> >>
>> >> >> >> Uninit was created at:
>> >> >> >> kmsan_save_stack_with_flags mm/kmsan/kmsan.c:256 [inline]
>> >> >> >> kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:181
>> >> >> >> kmsan_kmalloc+0x98/0x100 mm/kmsan/kmsan_hooks.c:91
>> >> >> >> __kmalloc_node+0x7bf/0x11c0 mm/slub.c:3828
>> >> >> >> kmalloc_node include/linux/slab.h:555 [inline]
>> >> >> >> kvmalloc_node+0x19d/0x3e0 mm/util.c:423
>> >> >> >> kvmalloc include/linux/mm.h:577 [inline]
>> >> >> >> snd_rawmidi_runtime_create sound/core/rawmidi.c:132 [inline]
>> >> >> >> open_substream+0x3c8/0xaa0 sound/core/rawmidi.c:276
>> >> >> >> rawmidi_open_priv+0x347/0x1000 sound/core/rawmidi.c:327
>> >> >> >> snd_rawmidi_open+0x7d4/0x1120 sound/core/rawmidi.c:424
>> >> >> >> soundcore_open+0x9be/0xa60 sound/sound_core.c:597
>> >> >> >> chrdev_open+0xc26/0xdb0 fs/char_dev.c:417
>> >> >> >> do_dentry_open+0xce6/0x1740 fs/open.c:771
>> >> >> >> vfs_open+0xaf/0xe0 fs/open.c:880
>> >> >> >> do_last fs/namei.c:3418 [inline]
>> >> >> >> path_openat+0x1799/0x6870 fs/namei.c:3534
>> >> >> >> do_filp_open+0x259/0x610 fs/namei.c:3564
>> >> >> >> do_sys_open+0x630/0x940 fs/open.c:1063
>> >> >> >> __do_sys_open fs/open.c:1081 [inline]
>> >> >> >> __se_sys_open+0xad/0xc0 fs/open.c:1076
>> >> >> >> __x64_sys_open+0x4a/0x70 fs/open.c:1076
>> >> >> >> do_syscall_64+0xb8/0x100 arch/x86/entry/common.c:291
>> >> >> >> entry_SYSCALL_64_after_hwframe+0x63/0xe7
>> >> >> >> ==================================================================
>> >> >>
>> >> >> > This looks like some small race at virmidi reading and the buffer
>> >> >> > handling, which should be almost harmless by itself.
>> >> >> > Nevertheless, the fix should be easy, just replacing kvmalloc() with
>> >> >> > kvzalloc(), as below.
>> >> >>
>> >> >> > Let's check whether this works.
>> >> >>
>> >> >> > #syz test:
>> >> >> > git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git
>> >> >> > topic/rawmidi-fixes
>> >> >>
>> >> >> KMSAN bugs can only be tested on https://github.com/google/kmsan.git tree
>> >> >> because KMSAN tool is not upstreamed yet.
>> >> >> See
>> >> >> https://github.com/google/syzkaller/blob/master/docs/syzbot.md#kmsan-bugs
>> >> >> for details.
>> >> >
>> >> > So how is the procedure to test a patch for bugs spotted by KMSAN?
>> >> >
>> >> > In this case, the fix is trivial, so I can put it to my tree for the
>> >> > next pull request. Of course, it'd be better if it can be confirmed
>> >> > to work beforehand...
>> >>
>> >> https://github.com/google/syzkaller/blob/master/docs/syzbot.md#kmsan-bugs
>> >>
>> >> Which means you need to attach a patch because it's not in that tree.
>> >
>> > OK, it would have been helpful if the description there was more clear
>> > :)
>> >
>> > And no automated way for that?
>>
>> What exactly do you mean? Please elaborate.
>
> Well, it's not clear which action is required to let syzbot testing
> some patch. The description says:
>
> "KMSAN is not upstream yet, though, we want to upstream it later. For
> now, it lives in github.com/google/kmsan and is based on a
> reasonably fresh upstream tree. As the result, any patch testing
> requests for KMSAN bugs need to go to KMSAN tree
> (https://github.com/google/kmsan.git repo, master branch)."
>
> Here, "need to go to KMSAN tree" part doesn't explain what exactly to
> do. Remember that many kernel devs (including the man in the mirror)
> don't use github, at least, not dealing github PRs for kernel
> development itself, so it's a pretty unfamiliar process.
It's not patches that need to go into that tree (i.e. no PRs). It's
patch testing requests.
Tried to clarify doc:
https://github.com/google/syzkaller/commit/bfe906cbb9c73c326f24327e1a89bc0cd0c314c7#diff-5b3b5ff5f03b01e1d31ec93aafd2f3d5
Does this look better?
>> > I mean, I already attached patch in
>> > the previous reply (together with syz-magic command to point the git
>> > branch URL). Do I need anything else?
>>
>> Just issue the command against "https://github.com/google/kmsan.git
>> master" and attach the patch.
>
> But it's basically a fix for the upstream tree, not about KMSAN
> itself. A PR to that tree doesn't sound right to me...
You don't need to send a PR. You attach a patch (or inline in email)
and request to apply and test it in KMSAN tree.
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: KMSAN: uninit-value in snd_midi_event_encode_byte
2018-09-03 14:19 ` Dmitry Vyukov
@ 2018-09-03 14:30 ` Takashi Iwai
2018-09-03 14:54 ` Dmitry Vyukov
0 siblings, 1 reply; 17+ messages in thread
From: Takashi Iwai @ 2018-09-03 14:30 UTC (permalink / raw)
To: Dmitry Vyukov
Cc: syzbot, alsa-devel-bounces, alsa-devel, LKML, Jaroslav Kysela,
syzkaller-bugs
On Mon, 03 Sep 2018 16:19:23 +0200,
Dmitry Vyukov wrote:
>
> On Mon, Sep 3, 2018 at 4:04 PM, Takashi Iwai <tiwai@suse.de> wrote:
> > On Mon, 03 Sep 2018 15:41:36 +0200,
> > Dmitry Vyukov wrote:
> >>
> >> On Mon, Sep 3, 2018 at 3:37 PM, Takashi Iwai <tiwai@suse.de> wrote:
> >> > On Mon, 03 Sep 2018 15:33:12 +0200,
> >> > Dmitry Vyukov wrote:
> >> >>
> >> >> On Mon, Sep 3, 2018 at 3:29 PM, Takashi Iwai <tiwai@suse.de> wrote:
> >> >> > On Mon, 03 Sep 2018 15:22:42 +0200,
> >> >> > syzbot wrote:
> >> >> >>
> >> >> >> > On Mon, 03 Sep 2018 03:53:03 +0200,
> >> >> >> > syzbot wrote:
> >> >> >>
> >> >> >> >> syzbot has found a reproducer for the following crash on:
> >> >> >>
> >> >> >> >> HEAD commit: 28f0ca98eadf kmsan: don't instrument
> >> >> >> >> do_syscall_64() and _..
> >> >> >> >> git tree: https://github.com/google/kmsan.git/master
> >> >> >> >> console output: https://syzkaller.appspot.com/x/log.txt?x=10556c92400000
> >> >> >> >> kernel config:
> >> >> >> >> https://syzkaller.appspot.com/x/.config?x=3431f03869413153
> >> >> >> >> dashboard link:
> >> >> >> >> https://syzkaller.appspot.com/bug?extid=194dffdb8b22fc5d207a
> >> >> >> >> compiler: clang version 8.0.0 (trunk 339414)
> >> >> >> >> syz repro:
> >> >> >> >> https://syzkaller.appspot.com/x/repro.syz?x=123a520a400000
> >> >> >> >> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16068dc1400000
> >> >> >>
> >> >> >> >> IMPORTANT: if you fix the bug, please add the following tag to the
> >> >> >> >> commit:
> >> >> >> >> Reported-by: syzbot+194dffdb8b22fc5d207a@syzkaller.appspotmail.com
> >> >> >>
> >> >> >> >> ==================================================================
> >> >> >> >> BUG: KMSAN: uninit-value in snd_midi_event_encode_byte+0x569/0xff0
> >> >> >> >> sound/core/seq/seq_midi_event.c:195
> >> >> >> >> CPU: 1 PID: 1659 Comm: kworker/1:1H Not tainted 4.19.0-rc1+ #40
> >> >> >> >> Hardware name: Google Google Compute Engine/Google Compute Engine,
> >> >> >> >> BIOS Google 01/01/2011
> >> >> >> >> Workqueue: events_highpri snd_vmidi_output_work
> >> >> >> >> Call Trace:
> >> >> >> >> __dump_stack lib/dump_stack.c:77 [inline]
> >> >> >> >> dump_stack+0x14b/0x190 lib/dump_stack.c:113
> >> >> >> >> kmsan_report+0x183/0x2b0 mm/kmsan/kmsan.c:956
> >> >> >> >> __msan_warning+0x70/0xc0 mm/kmsan/kmsan_instr.c:645
> >> >> >> >> snd_midi_event_encode_byte+0x569/0xff0
> >> >> >> >> sound/core/seq/seq_midi_event.c:195
> >> >> >> >> snd_vmidi_output_work+0x34e/0x5b0 sound/core/seq/seq_virmidi.c:161
> >> >> >> >> process_one_work+0x1605/0x1f40 kernel/workqueue.c:2153
> >> >> >> >> worker_thread+0x11a2/0x2590 kernel/workqueue.c:2296
> >> >> >> >> kthread+0x465/0x4a0 kernel/kthread.c:247
> >> >> >> >> ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:416
> >> >> >>
> >> >> >> >> Uninit was stored to memory at:
> >> >> >> >> kmsan_save_stack_with_flags mm/kmsan/kmsan.c:256 [inline]
> >> >> >> >> kmsan_save_stack mm/kmsan/kmsan.c:271 [inline]
> >> >> >> >> kmsan_internal_chain_origin+0x128/0x210 mm/kmsan/kmsan.c:573
> >> >> >> >> __msan_chain_origin+0x69/0xc0 mm/kmsan/kmsan_instr.c:482
> >> >> >> >> __snd_rawmidi_transmit_peek sound/core/rawmidi.c:1103 [inline]
> >> >> >> >> snd_rawmidi_transmit+0xa75/0xbf0 sound/core/rawmidi.c:1228
> >> >> >> >> snd_vmidi_output_work+0x2ac/0x5b0 sound/core/seq/seq_virmidi.c:159
> >> >> >> >> process_one_work+0x1605/0x1f40 kernel/workqueue.c:2153
> >> >> >> >> worker_thread+0x11a2/0x2590 kernel/workqueue.c:2296
> >> >> >> >> kthread+0x465/0x4a0 kernel/kthread.c:247
> >> >> >> >> ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:416
> >> >> >>
> >> >> >> >> Uninit was created at:
> >> >> >> >> kmsan_save_stack_with_flags mm/kmsan/kmsan.c:256 [inline]
> >> >> >> >> kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:181
> >> >> >> >> kmsan_kmalloc+0x98/0x100 mm/kmsan/kmsan_hooks.c:91
> >> >> >> >> __kmalloc_node+0x7bf/0x11c0 mm/slub.c:3828
> >> >> >> >> kmalloc_node include/linux/slab.h:555 [inline]
> >> >> >> >> kvmalloc_node+0x19d/0x3e0 mm/util.c:423
> >> >> >> >> kvmalloc include/linux/mm.h:577 [inline]
> >> >> >> >> snd_rawmidi_runtime_create sound/core/rawmidi.c:132 [inline]
> >> >> >> >> open_substream+0x3c8/0xaa0 sound/core/rawmidi.c:276
> >> >> >> >> rawmidi_open_priv+0x347/0x1000 sound/core/rawmidi.c:327
> >> >> >> >> snd_rawmidi_open+0x7d4/0x1120 sound/core/rawmidi.c:424
> >> >> >> >> soundcore_open+0x9be/0xa60 sound/sound_core.c:597
> >> >> >> >> chrdev_open+0xc26/0xdb0 fs/char_dev.c:417
> >> >> >> >> do_dentry_open+0xce6/0x1740 fs/open.c:771
> >> >> >> >> vfs_open+0xaf/0xe0 fs/open.c:880
> >> >> >> >> do_last fs/namei.c:3418 [inline]
> >> >> >> >> path_openat+0x1799/0x6870 fs/namei.c:3534
> >> >> >> >> do_filp_open+0x259/0x610 fs/namei.c:3564
> >> >> >> >> do_sys_open+0x630/0x940 fs/open.c:1063
> >> >> >> >> __do_sys_open fs/open.c:1081 [inline]
> >> >> >> >> __se_sys_open+0xad/0xc0 fs/open.c:1076
> >> >> >> >> __x64_sys_open+0x4a/0x70 fs/open.c:1076
> >> >> >> >> do_syscall_64+0xb8/0x100 arch/x86/entry/common.c:291
> >> >> >> >> entry_SYSCALL_64_after_hwframe+0x63/0xe7
> >> >> >> >> ==================================================================
> >> >> >>
> >> >> >> > This looks like some small race at virmidi reading and the buffer
> >> >> >> > handling, which should be almost harmless by itself.
> >> >> >> > Nevertheless, the fix should be easy, just replacing kvmalloc() with
> >> >> >> > kvzalloc(), as below.
> >> >> >>
> >> >> >> > Let's check whether this works.
> >> >> >>
> >> >> >> > #syz test:
> >> >> >> > git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git
> >> >> >> > topic/rawmidi-fixes
> >> >> >>
> >> >> >> KMSAN bugs can only be tested on https://github.com/google/kmsan.git tree
> >> >> >> because KMSAN tool is not upstreamed yet.
> >> >> >> See
> >> >> >> https://github.com/google/syzkaller/blob/master/docs/syzbot.md#kmsan-bugs
> >> >> >> for details.
> >> >> >
> >> >> > So how is the procedure to test a patch for bugs spotted by KMSAN?
> >> >> >
> >> >> > In this case, the fix is trivial, so I can put it to my tree for the
> >> >> > next pull request. Of course, it'd be better if it can be confirmed
> >> >> > to work beforehand...
> >> >>
> >> >> https://github.com/google/syzkaller/blob/master/docs/syzbot.md#kmsan-bugs
> >> >>
> >> >> Which means you need to attach a patch because it's not in that tree.
> >> >
> >> > OK, it would have been helpful if the description there was more clear
> >> > :)
> >> >
> >> > And no automated way for that?
> >>
> >> What exactly do you mean? Please elaborate.
> >
> > Well, it's not clear which action is required to let syzbot testing
> > some patch. The description says:
> >
> > "KMSAN is not upstream yet, though, we want to upstream it later. For
> > now, it lives in github.com/google/kmsan and is based on a
> > reasonably fresh upstream tree. As the result, any patch testing
> > requests for KMSAN bugs need to go to KMSAN tree
> > (https://github.com/google/kmsan.git repo, master branch)."
> >
> > Here, "need to go to KMSAN tree" part doesn't explain what exactly to
> > do. Remember that many kernel devs (including the man in the mirror)
> > don't use github, at least, not dealing github PRs for kernel
> > development itself, so it's a pretty unfamiliar process.
>
> It's not patches that need to go into that tree (i.e. no PRs). It's
> patch testing requests.
>
> Tried to clarify doc:
>
> https://github.com/google/syzkaller/commit/bfe906cbb9c73c326f24327e1a89bc0cd0c314c7#diff-5b3b5ff5f03b01e1d31ec93aafd2f3d5
>
> Does this look better?
Erm, sorry, still unclear to me. I'd need to explicitl attch/inline
the patch for testing *to where*? Attach the test patch to the e-mail
replying to the bug?
Also, now you've put an example referring to
https://github.com/google/kmsan.git master. What does it mean?
I should have put that line in my reply?
> >> > I mean, I already attached patch in
> >> > the previous reply (together with syz-magic command to point the git
> >> > branch URL). Do I need anything else?
> >>
> >> Just issue the command against "https://github.com/google/kmsan.git
> >> master" and attach the patch.
> >
> > But it's basically a fix for the upstream tree, not about KMSAN
> > itself. A PR to that tree doesn't sound right to me...
>
> You don't need to send a PR. You attach a patch (or inline in email)
> and request to apply and test it in KMSAN tree.
Then I must have understood "just issue the command against..."
Does it mean the "syz test: https//github.com/google/kmsan.git
master"?
I need to learn the basic for understanding the black magic...
thanks,
Takashi
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: KMSAN: uninit-value in snd_midi_event_encode_byte
2018-09-03 14:30 ` Takashi Iwai
@ 2018-09-03 14:54 ` Dmitry Vyukov
2018-09-03 15:00 ` Takashi Iwai
0 siblings, 1 reply; 17+ messages in thread
From: Dmitry Vyukov @ 2018-09-03 14:54 UTC (permalink / raw)
To: Takashi Iwai
Cc: syzbot, alsa-devel-bounces, alsa-devel, LKML, Jaroslav Kysela,
syzkaller-bugs
On Mon, Sep 3, 2018 at 4:30 PM, Takashi Iwai <tiwai@suse.de> wrote:
> On Mon, 03 Sep 2018 16:19:23 +0200,
> Dmitry Vyukov wrote:
>>
>> On Mon, Sep 3, 2018 at 4:04 PM, Takashi Iwai <tiwai@suse.de> wrote:
>> > On Mon, 03 Sep 2018 15:41:36 +0200,
>> > Dmitry Vyukov wrote:
>> >>
>> >> On Mon, Sep 3, 2018 at 3:37 PM, Takashi Iwai <tiwai@suse.de> wrote:
>> >> > On Mon, 03 Sep 2018 15:33:12 +0200,
>> >> > Dmitry Vyukov wrote:
>> >> >>
>> >> >> On Mon, Sep 3, 2018 at 3:29 PM, Takashi Iwai <tiwai@suse.de> wrote:
>> >> >> > On Mon, 03 Sep 2018 15:22:42 +0200,
>> >> >> > syzbot wrote:
>> >> >> >>
>> >> >> >> > On Mon, 03 Sep 2018 03:53:03 +0200,
>> >> >> >> > syzbot wrote:
>> >> >> >>
>> >> >> >> >> syzbot has found a reproducer for the following crash on:
>> >> >> >>
>> >> >> >> >> HEAD commit: 28f0ca98eadf kmsan: don't instrument
>> >> >> >> >> do_syscall_64() and _..
>> >> >> >> >> git tree: https://github.com/google/kmsan.git/master
>> >> >> >> >> console output: https://syzkaller.appspot.com/x/log.txt?x=10556c92400000
>> >> >> >> >> kernel config:
>> >> >> >> >> https://syzkaller.appspot.com/x/.config?x=3431f03869413153
>> >> >> >> >> dashboard link:
>> >> >> >> >> https://syzkaller.appspot.com/bug?extid=194dffdb8b22fc5d207a
>> >> >> >> >> compiler: clang version 8.0.0 (trunk 339414)
>> >> >> >> >> syz repro:
>> >> >> >> >> https://syzkaller.appspot.com/x/repro.syz?x=123a520a400000
>> >> >> >> >> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16068dc1400000
>> >> >> >>
>> >> >> >> >> IMPORTANT: if you fix the bug, please add the following tag to the
>> >> >> >> >> commit:
>> >> >> >> >> Reported-by: syzbot+194dffdb8b22fc5d207a@syzkaller.appspotmail.com
>> >> >> >>
>> >> >> >> >> ==================================================================
>> >> >> >> >> BUG: KMSAN: uninit-value in snd_midi_event_encode_byte+0x569/0xff0
>> >> >> >> >> sound/core/seq/seq_midi_event.c:195
>> >> >> >> >> CPU: 1 PID: 1659 Comm: kworker/1:1H Not tainted 4.19.0-rc1+ #40
>> >> >> >> >> Hardware name: Google Google Compute Engine/Google Compute Engine,
>> >> >> >> >> BIOS Google 01/01/2011
>> >> >> >> >> Workqueue: events_highpri snd_vmidi_output_work
>> >> >> >> >> Call Trace:
>> >> >> >> >> __dump_stack lib/dump_stack.c:77 [inline]
>> >> >> >> >> dump_stack+0x14b/0x190 lib/dump_stack.c:113
>> >> >> >> >> kmsan_report+0x183/0x2b0 mm/kmsan/kmsan.c:956
>> >> >> >> >> __msan_warning+0x70/0xc0 mm/kmsan/kmsan_instr.c:645
>> >> >> >> >> snd_midi_event_encode_byte+0x569/0xff0
>> >> >> >> >> sound/core/seq/seq_midi_event.c:195
>> >> >> >> >> snd_vmidi_output_work+0x34e/0x5b0 sound/core/seq/seq_virmidi.c:161
>> >> >> >> >> process_one_work+0x1605/0x1f40 kernel/workqueue.c:2153
>> >> >> >> >> worker_thread+0x11a2/0x2590 kernel/workqueue.c:2296
>> >> >> >> >> kthread+0x465/0x4a0 kernel/kthread.c:247
>> >> >> >> >> ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:416
>> >> >> >>
>> >> >> >> >> Uninit was stored to memory at:
>> >> >> >> >> kmsan_save_stack_with_flags mm/kmsan/kmsan.c:256 [inline]
>> >> >> >> >> kmsan_save_stack mm/kmsan/kmsan.c:271 [inline]
>> >> >> >> >> kmsan_internal_chain_origin+0x128/0x210 mm/kmsan/kmsan.c:573
>> >> >> >> >> __msan_chain_origin+0x69/0xc0 mm/kmsan/kmsan_instr.c:482
>> >> >> >> >> __snd_rawmidi_transmit_peek sound/core/rawmidi.c:1103 [inline]
>> >> >> >> >> snd_rawmidi_transmit+0xa75/0xbf0 sound/core/rawmidi.c:1228
>> >> >> >> >> snd_vmidi_output_work+0x2ac/0x5b0 sound/core/seq/seq_virmidi.c:159
>> >> >> >> >> process_one_work+0x1605/0x1f40 kernel/workqueue.c:2153
>> >> >> >> >> worker_thread+0x11a2/0x2590 kernel/workqueue.c:2296
>> >> >> >> >> kthread+0x465/0x4a0 kernel/kthread.c:247
>> >> >> >> >> ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:416
>> >> >> >>
>> >> >> >> >> Uninit was created at:
>> >> >> >> >> kmsan_save_stack_with_flags mm/kmsan/kmsan.c:256 [inline]
>> >> >> >> >> kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:181
>> >> >> >> >> kmsan_kmalloc+0x98/0x100 mm/kmsan/kmsan_hooks.c:91
>> >> >> >> >> __kmalloc_node+0x7bf/0x11c0 mm/slub.c:3828
>> >> >> >> >> kmalloc_node include/linux/slab.h:555 [inline]
>> >> >> >> >> kvmalloc_node+0x19d/0x3e0 mm/util.c:423
>> >> >> >> >> kvmalloc include/linux/mm.h:577 [inline]
>> >> >> >> >> snd_rawmidi_runtime_create sound/core/rawmidi.c:132 [inline]
>> >> >> >> >> open_substream+0x3c8/0xaa0 sound/core/rawmidi.c:276
>> >> >> >> >> rawmidi_open_priv+0x347/0x1000 sound/core/rawmidi.c:327
>> >> >> >> >> snd_rawmidi_open+0x7d4/0x1120 sound/core/rawmidi.c:424
>> >> >> >> >> soundcore_open+0x9be/0xa60 sound/sound_core.c:597
>> >> >> >> >> chrdev_open+0xc26/0xdb0 fs/char_dev.c:417
>> >> >> >> >> do_dentry_open+0xce6/0x1740 fs/open.c:771
>> >> >> >> >> vfs_open+0xaf/0xe0 fs/open.c:880
>> >> >> >> >> do_last fs/namei.c:3418 [inline]
>> >> >> >> >> path_openat+0x1799/0x6870 fs/namei.c:3534
>> >> >> >> >> do_filp_open+0x259/0x610 fs/namei.c:3564
>> >> >> >> >> do_sys_open+0x630/0x940 fs/open.c:1063
>> >> >> >> >> __do_sys_open fs/open.c:1081 [inline]
>> >> >> >> >> __se_sys_open+0xad/0xc0 fs/open.c:1076
>> >> >> >> >> __x64_sys_open+0x4a/0x70 fs/open.c:1076
>> >> >> >> >> do_syscall_64+0xb8/0x100 arch/x86/entry/common.c:291
>> >> >> >> >> entry_SYSCALL_64_after_hwframe+0x63/0xe7
>> >> >> >> >> ==================================================================
>> >> >> >>
>> >> >> >> > This looks like some small race at virmidi reading and the buffer
>> >> >> >> > handling, which should be almost harmless by itself.
>> >> >> >> > Nevertheless, the fix should be easy, just replacing kvmalloc() with
>> >> >> >> > kvzalloc(), as below.
>> >> >> >>
>> >> >> >> > Let's check whether this works.
>> >> >> >>
>> >> >> >> > #syz test:
>> >> >> >> > git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git
>> >> >> >> > topic/rawmidi-fixes
>> >> >> >>
>> >> >> >> KMSAN bugs can only be tested on https://github.com/google/kmsan.git tree
>> >> >> >> because KMSAN tool is not upstreamed yet.
>> >> >> >> See
>> >> >> >> https://github.com/google/syzkaller/blob/master/docs/syzbot.md#kmsan-bugs
>> >> >> >> for details.
>> >> >> >
>> >> >> > So how is the procedure to test a patch for bugs spotted by KMSAN?
>> >> >> >
>> >> >> > In this case, the fix is trivial, so I can put it to my tree for the
>> >> >> > next pull request. Of course, it'd be better if it can be confirmed
>> >> >> > to work beforehand...
>> >> >>
>> >> >> https://github.com/google/syzkaller/blob/master/docs/syzbot.md#kmsan-bugs
>> >> >>
>> >> >> Which means you need to attach a patch because it's not in that tree.
>> >> >
>> >> > OK, it would have been helpful if the description there was more clear
>> >> > :)
>> >> >
>> >> > And no automated way for that?
>> >>
>> >> What exactly do you mean? Please elaborate.
>> >
>> > Well, it's not clear which action is required to let syzbot testing
>> > some patch. The description says:
>> >
>> > "KMSAN is not upstream yet, though, we want to upstream it later. For
>> > now, it lives in github.com/google/kmsan and is based on a
>> > reasonably fresh upstream tree. As the result, any patch testing
>> > requests for KMSAN bugs need to go to KMSAN tree
>> > (https://github.com/google/kmsan.git repo, master branch)."
>> >
>> > Here, "need to go to KMSAN tree" part doesn't explain what exactly to
>> > do. Remember that many kernel devs (including the man in the mirror)
>> > don't use github, at least, not dealing github PRs for kernel
>> > development itself, so it's a pretty unfamiliar process.
>>
>> It's not patches that need to go into that tree (i.e. no PRs). It's
>> patch testing requests.
>>
>> Tried to clarify doc:
>>
>> https://github.com/google/syzkaller/commit/bfe906cbb9c73c326f24327e1a89bc0cd0c314c7#diff-5b3b5ff5f03b01e1d31ec93aafd2f3d5
>>
>> Does this look better?
>
> Erm, sorry, still unclear to me. I'd need to explicitl attch/inline
> the patch for testing *to where*? Attach the test patch to the e-mail
> replying to the bug?
>
> Also, now you've put an example referring to
> https://github.com/google/kmsan.git master. What does it mean?
> I should have put that line in my reply?
>
>> >> > I mean, I already attached patch in
>> >> > the previous reply (together with syz-magic command to point the git
>> >> > branch URL). Do I need anything else?
>> >>
>> >> Just issue the command against "https://github.com/google/kmsan.git
>> >> master" and attach the patch.
>> >
>> > But it's basically a fix for the upstream tree, not about KMSAN
>> > itself. A PR to that tree doesn't sound right to me...
>>
>> You don't need to send a PR. You attach a patch (or inline in email)
>> and request to apply and test it in KMSAN tree.
>
> Then I must have understood "just issue the command against..."
> Does it mean the "syz test: https//github.com/google/kmsan.git
> master"?
>
> I need to learn the basic for understanding the black magic...
https://github.com/google/syzkaller/blob/master/docs/syzbot.md#kmsan-bugs
is meant to be a complement to the previous generic descriptions of
patch testing process, which is:
https://github.com/google/syzkaller/blob/master/docs/syzbot.md#testing-patches
So, you always reply to the syzbot+HASH email address so that syzbot
understands which bug we are talking about.
Then you do either (omitting # so that syzbot won't consider that as
actual test requests):
syz test: git://repo/address.git branch
or:
syz test: git://repo/address.git commit-hash
And then you can either attach a patch that needs to be applied on
top, or not attach it (if it's already in the tree, or you just want
to get another crash report).
For KMSAN you need to issue test request against
"https//github.com/google/kmsan.git master" (that's the only tree that
has KMSAN tool in it) and you need to attach/inline the patch (because
your patch is obviously not there yet).
Does this make things more clear?
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: KMSAN: uninit-value in snd_midi_event_encode_byte
2018-09-03 14:54 ` Dmitry Vyukov
@ 2018-09-03 15:00 ` Takashi Iwai
2018-09-03 15:06 ` Dmitry Vyukov
0 siblings, 1 reply; 17+ messages in thread
From: Takashi Iwai @ 2018-09-03 15:00 UTC (permalink / raw)
To: Dmitry Vyukov
Cc: syzbot, alsa-devel-bounces, alsa-devel, LKML, Jaroslav Kysela,
syzkaller-bugs
On Mon, 03 Sep 2018 16:54:23 +0200,
Dmitry Vyukov wrote:
>
> https://github.com/google/syzkaller/blob/master/docs/syzbot.md#kmsan-bugs
> is meant to be a complement to the previous generic descriptions of
> patch testing process, which is:
> https://github.com/google/syzkaller/blob/master/docs/syzbot.md#testing-patches
>
> So, you always reply to the syzbot+HASH email address so that syzbot
> understands which bug we are talking about.
> Then you do either (omitting # so that syzbot won't consider that as
> actual test requests):
>
> syz test: git://repo/address.git branch
>
> or:
>
> syz test: git://repo/address.git commit-hash
>
> And then you can either attach a patch that needs to be applied on
> top, or not attach it (if it's already in the tree, or you just want
> to get another crash report).
OK, so far, so good, it's what I knew and have done a few times.
> For KMSAN you need to issue test request against
> "https//github.com/google/kmsan.git master" (that's the only tree that
> has KMSAN tool in it) and you need to attach/inline the patch (because
> your patch is obviously not there yet).
>
> Does this make things more clear?
Sorry, the part "issue test request against https..." still isn't
clear.
Do you mean to open an issue entry on github, and attach the patch
there?
Takashi
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: KMSAN: uninit-value in snd_midi_event_encode_byte
2018-09-03 15:00 ` Takashi Iwai
@ 2018-09-03 15:06 ` Dmitry Vyukov
2018-09-03 15:18 ` Takashi Iwai
0 siblings, 1 reply; 17+ messages in thread
From: Dmitry Vyukov @ 2018-09-03 15:06 UTC (permalink / raw)
To: Takashi Iwai
Cc: syzbot, alsa-devel-bounces, alsa-devel, LKML, Jaroslav Kysela,
syzkaller-bugs
On Mon, Sep 3, 2018 at 5:00 PM, Takashi Iwai <tiwai@suse.de> wrote:
> On Mon, 03 Sep 2018 16:54:23 +0200,
> Dmitry Vyukov wrote:
>>
>> https://github.com/google/syzkaller/blob/master/docs/syzbot.md#kmsan-bugs
>> is meant to be a complement to the previous generic descriptions of
>> patch testing process, which is:
>> https://github.com/google/syzkaller/blob/master/docs/syzbot.md#testing-patches
>>
>> So, you always reply to the syzbot+HASH email address so that syzbot
>> understands which bug we are talking about.
>> Then you do either (omitting # so that syzbot won't consider that as
>> actual test requests):
>>
>> syz test: git://repo/address.git branch
>>
>> or:
>>
>> syz test: git://repo/address.git commit-hash
>>
>> And then you can either attach a patch that needs to be applied on
>> top, or not attach it (if it's already in the tree, or you just want
>> to get another crash report).
>
> OK, so far, so good, it's what I knew and have done a few times.
>
>
>> For KMSAN you need to issue test request against
>> "https//github.com/google/kmsan.git master" (that's the only tree that
>> has KMSAN tool in it) and you need to attach/inline the patch (because
>> your patch is obviously not there yet).
>>
>> Does this make things more clear?
>
> Sorry, the part "issue test request against https..." still isn't
> clear.
>
> Do you mean to open an issue entry on github, and attach the patch
> there?
By "issue test request" I mean sending email with "syz test" command.
So overall you send "syz test https//github.com/google/kmsan.git
master" and attach the patch.
The workflow is all the same, and no github involved. It's just that
you can't ask to test it against
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git because
it does not have KMSAN tool and so no KMSAN bugs will be detected
there.
Since I did all of this, it's hard for me to write clear docs for others. Sorry.
If you can suggest some improved wording, it would be great.
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: KMSAN: uninit-value in snd_midi_event_encode_byte
2018-09-03 15:06 ` Dmitry Vyukov
@ 2018-09-03 15:18 ` Takashi Iwai
2018-09-03 17:25 ` Dmitry Vyukov
0 siblings, 1 reply; 17+ messages in thread
From: Takashi Iwai @ 2018-09-03 15:18 UTC (permalink / raw)
To: Dmitry Vyukov
Cc: syzbot, alsa-devel-bounces, alsa-devel, LKML, Jaroslav Kysela,
syzkaller-bugs
On Mon, 03 Sep 2018 17:06:05 +0200,
Dmitry Vyukov wrote:
>
> On Mon, Sep 3, 2018 at 5:00 PM, Takashi Iwai <tiwai@suse.de> wrote:
> > On Mon, 03 Sep 2018 16:54:23 +0200,
> > Dmitry Vyukov wrote:
> >>
> >> https://github.com/google/syzkaller/blob/master/docs/syzbot.md#kmsan-bugs
> >> is meant to be a complement to the previous generic descriptions of
> >> patch testing process, which is:
> >> https://github.com/google/syzkaller/blob/master/docs/syzbot.md#testing-patches
> >>
> >> So, you always reply to the syzbot+HASH email address so that syzbot
> >> understands which bug we are talking about.
> >> Then you do either (omitting # so that syzbot won't consider that as
> >> actual test requests):
> >>
> >> syz test: git://repo/address.git branch
> >>
> >> or:
> >>
> >> syz test: git://repo/address.git commit-hash
> >>
> >> And then you can either attach a patch that needs to be applied on
> >> top, or not attach it (if it's already in the tree, or you just want
> >> to get another crash report).
> >
> > OK, so far, so good, it's what I knew and have done a few times.
> >
> >
> >> For KMSAN you need to issue test request against
> >> "https//github.com/google/kmsan.git master" (that's the only tree that
> >> has KMSAN tool in it) and you need to attach/inline the patch (because
> >> your patch is obviously not there yet).
> >>
> >> Does this make things more clear?
> >
> > Sorry, the part "issue test request against https..." still isn't
> > clear.
> >
> > Do you mean to open an issue entry on github, and attach the patch
> > there?
>
> By "issue test request" I mean sending email with "syz test" command.
> So overall you send "syz test https//github.com/google/kmsan.git
> master" and attach the patch.
> The workflow is all the same, and no github involved. It's just that
> you can't ask to test it against
> git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git because
> it does not have KMSAN tool and so no KMSAN bugs will be detected
> there.
Thanks, this finally made me understanding the whole picture!
> Since I did all of this, it's hard for me to write clear docs for others. Sorry.
> If you can suggest some improved wording, it would be great.
Well, how about like below?
KMSAN is not upstream yet, though, we want to upstream it later. For
now, it lives in github.com/google/kmsan and is based on a reasonably
fresh upstream tree. As the result, any patch testing requests for
KMSAN bugs need to go to KMSAN tree
(https://github.com/google/kmsan.git repo, master branch).
A standard way for triggering the test with KMSAN tree is to send an
email to syzbot+HASH address containing the following line:
#syz test: https://github.com/google/kmsan.git master
and attach/inline your test patch in the same mail.
Takashi
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: KMSAN: uninit-value in snd_midi_event_encode_byte
2018-09-03 15:18 ` Takashi Iwai
@ 2018-09-03 17:25 ` Dmitry Vyukov
2018-09-03 21:35 ` Takashi Iwai
0 siblings, 1 reply; 17+ messages in thread
From: Dmitry Vyukov @ 2018-09-03 17:25 UTC (permalink / raw)
To: Takashi Iwai
Cc: syzbot, alsa-devel-bounces, alsa-devel, LKML, Jaroslav Kysela,
syzkaller-bugs
On Mon, Sep 3, 2018 at 5:18 PM, Takashi Iwai <tiwai@suse.de> wrote:
> On Mon, 03 Sep 2018 17:06:05 +0200,
> Dmitry Vyukov wrote:
>>
>> On Mon, Sep 3, 2018 at 5:00 PM, Takashi Iwai <tiwai@suse.de> wrote:
>> > On Mon, 03 Sep 2018 16:54:23 +0200,
>> > Dmitry Vyukov wrote:
>> >>
>> >> https://github.com/google/syzkaller/blob/master/docs/syzbot.md#kmsan-bugs
>> >> is meant to be a complement to the previous generic descriptions of
>> >> patch testing process, which is:
>> >> https://github.com/google/syzkaller/blob/master/docs/syzbot.md#testing-patches
>> >>
>> >> So, you always reply to the syzbot+HASH email address so that syzbot
>> >> understands which bug we are talking about.
>> >> Then you do either (omitting # so that syzbot won't consider that as
>> >> actual test requests):
>> >>
>> >> syz test: git://repo/address.git branch
>> >>
>> >> or:
>> >>
>> >> syz test: git://repo/address.git commit-hash
>> >>
>> >> And then you can either attach a patch that needs to be applied on
>> >> top, or not attach it (if it's already in the tree, or you just want
>> >> to get another crash report).
>> >
>> > OK, so far, so good, it's what I knew and have done a few times.
>> >
>> >
>> >> For KMSAN you need to issue test request against
>> >> "https//github.com/google/kmsan.git master" (that's the only tree that
>> >> has KMSAN tool in it) and you need to attach/inline the patch (because
>> >> your patch is obviously not there yet).
>> >>
>> >> Does this make things more clear?
>> >
>> > Sorry, the part "issue test request against https..." still isn't
>> > clear.
>> >
>> > Do you mean to open an issue entry on github, and attach the patch
>> > there?
>>
>> By "issue test request" I mean sending email with "syz test" command.
>> So overall you send "syz test https//github.com/google/kmsan.git
>> master" and attach the patch.
>> The workflow is all the same, and no github involved. It's just that
>> you can't ask to test it against
>> git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git because
>> it does not have KMSAN tool and so no KMSAN bugs will be detected
>> there.
>
> Thanks, this finally made me understanding the whole picture!
>
>> Since I did all of this, it's hard for me to write clear docs for others. Sorry.
>> If you can suggest some improved wording, it would be great.
>
> Well, how about like below?
>
>
> KMSAN is not upstream yet, though, we want to upstream it later. For
> now, it lives in github.com/google/kmsan and is based on a reasonably
> fresh upstream tree. As the result, any patch testing requests for
> KMSAN bugs need to go to KMSAN tree
> (https://github.com/google/kmsan.git repo, master branch).
> A standard way for triggering the test with KMSAN tree is to send an
> email to syzbot+HASH address containing the following line:
>
> #syz test: https://github.com/google/kmsan.git master
>
> and attach/inline your test patch in the same mail.
Done:
https://github.com/google/syzkaller/commit/3ea6c028b154d2faea45142bfb15b02f3243800c#diff-5b3b5ff5f03b01e1d31ec93aafd2f3d5
Thanks
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: KMSAN: uninit-value in snd_midi_event_encode_byte
2018-09-03 17:25 ` Dmitry Vyukov
@ 2018-09-03 21:35 ` Takashi Iwai
0 siblings, 0 replies; 17+ messages in thread
From: Takashi Iwai @ 2018-09-03 21:35 UTC (permalink / raw)
To: Dmitry Vyukov
Cc: syzbot, alsa-devel-bounces, alsa-devel, LKML, Jaroslav Kysela,
syzkaller-bugs
On Mon, 03 Sep 2018 19:25:39 +0200,
Dmitry Vyukov wrote:
>
> On Mon, Sep 3, 2018 at 5:18 PM, Takashi Iwai <tiwai@suse.de> wrote:
> > On Mon, 03 Sep 2018 17:06:05 +0200,
> > Dmitry Vyukov wrote:
> >>
> >> On Mon, Sep 3, 2018 at 5:00 PM, Takashi Iwai <tiwai@suse.de> wrote:
> >> > On Mon, 03 Sep 2018 16:54:23 +0200,
> >> > Dmitry Vyukov wrote:
> >> >>
> >> >> https://github.com/google/syzkaller/blob/master/docs/syzbot.md#kmsan-bugs
> >> >> is meant to be a complement to the previous generic descriptions of
> >> >> patch testing process, which is:
> >> >> https://github.com/google/syzkaller/blob/master/docs/syzbot.md#testing-patches
> >> >>
> >> >> So, you always reply to the syzbot+HASH email address so that syzbot
> >> >> understands which bug we are talking about.
> >> >> Then you do either (omitting # so that syzbot won't consider that as
> >> >> actual test requests):
> >> >>
> >> >> syz test: git://repo/address.git branch
> >> >>
> >> >> or:
> >> >>
> >> >> syz test: git://repo/address.git commit-hash
> >> >>
> >> >> And then you can either attach a patch that needs to be applied on
> >> >> top, or not attach it (if it's already in the tree, or you just want
> >> >> to get another crash report).
> >> >
> >> > OK, so far, so good, it's what I knew and have done a few times.
> >> >
> >> >
> >> >> For KMSAN you need to issue test request against
> >> >> "https//github.com/google/kmsan.git master" (that's the only tree that
> >> >> has KMSAN tool in it) and you need to attach/inline the patch (because
> >> >> your patch is obviously not there yet).
> >> >>
> >> >> Does this make things more clear?
> >> >
> >> > Sorry, the part "issue test request against https..." still isn't
> >> > clear.
> >> >
> >> > Do you mean to open an issue entry on github, and attach the patch
> >> > there?
> >>
> >> By "issue test request" I mean sending email with "syz test" command.
> >> So overall you send "syz test https//github.com/google/kmsan.git
> >> master" and attach the patch.
> >> The workflow is all the same, and no github involved. It's just that
> >> you can't ask to test it against
> >> git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git because
> >> it does not have KMSAN tool and so no KMSAN bugs will be detected
> >> there.
> >
> > Thanks, this finally made me understanding the whole picture!
> >
> >> Since I did all of this, it's hard for me to write clear docs for others. Sorry.
> >> If you can suggest some improved wording, it would be great.
> >
> > Well, how about like below?
> >
> >
> > KMSAN is not upstream yet, though, we want to upstream it later. For
> > now, it lives in github.com/google/kmsan and is based on a reasonably
> > fresh upstream tree. As the result, any patch testing requests for
> > KMSAN bugs need to go to KMSAN tree
> > (https://github.com/google/kmsan.git repo, master branch).
> > A standard way for triggering the test with KMSAN tree is to send an
> > email to syzbot+HASH address containing the following line:
> >
> > #syz test: https://github.com/google/kmsan.git master
> >
> > and attach/inline your test patch in the same mail.
>
>
> Done:
> https://github.com/google/syzkaller/commit/3ea6c028b154d2faea45142bfb15b02f3243800c#diff-5b3b5ff5f03b01e1d31ec93aafd2f3d5
Thanks!
And about the bug in the subject: as syzbot returned a positive
feedback for my test patch, I queued it to for-linus branch now.
Takashi
^ permalink raw reply [flat|nested] 17+ messages in thread
end of thread, other threads:[~2018-09-03 21:35 UTC | newest]
Thread overview: 17+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-09-02 19:29 KMSAN: uninit-value in snd_midi_event_encode_byte syzbot
2018-09-03 1:53 ` syzbot
2018-09-03 13:22 ` Takashi Iwai
2018-09-03 13:22 ` syzbot
2018-09-03 13:29 ` Takashi Iwai
2018-09-03 13:33 ` Dmitry Vyukov
2018-09-03 13:37 ` Takashi Iwai
2018-09-03 13:41 ` Dmitry Vyukov
2018-09-03 14:04 ` Takashi Iwai
2018-09-03 14:19 ` Dmitry Vyukov
2018-09-03 14:30 ` Takashi Iwai
2018-09-03 14:54 ` Dmitry Vyukov
2018-09-03 15:00 ` Takashi Iwai
2018-09-03 15:06 ` Dmitry Vyukov
2018-09-03 15:18 ` Takashi Iwai
2018-09-03 17:25 ` Dmitry Vyukov
2018-09-03 21:35 ` Takashi Iwai
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).