Re: KMSAN: uninit-value in udf_evict_inode
On Thu 24-09-20 22:18:21, syzbot wrote: > Hello, > > syzbot found the following issue on: > > HEAD commit:c5a13b33 kmsan: clang-format core > git tree: https://github.com/google/kmsan.git master > console output: https://syzkaller.appspot.com/x/log.txt?x=142cf80990 > kernel config: https://syzkaller.appspot.com/x/.config?x=20f149ad694ba4be > dashboard link: https://syzkaller.appspot.com/bug?extid=91f02b28f9bb5f5f1341 > compiler: clang version 10.0.0 (https://github.com/llvm/llvm-project/ > c2443155a0fb245c8f17f2c1c72b6ea391e86e81) > userspace arch: i386 > > Unfortunately, I don't have any reproducer for this issue yet. > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > Reported-by: syzbot+91f02b28f9bb5f5f1...@syzkaller.appspotmail.com > > UDF-fs: warning (device loop3): udf_load_vrs: No anchor found > UDF-fs: Scanning with blocksize 512 failed > UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2020/09/19 18:44 (1000) > UDF-fs: error (device loop3): udf_read_inode: (ino 1328) failed !bh > ===== > BUG: KMSAN: uninit-value in udf_evict_inode+0x382/0x7d0 fs/udf/inode.c:150 Yeah, easy enough. I'll send a fix. Honza -- Jan Kara SUSE Labs, CR
KMSAN: uninit-value in udf_evict_inode
Hello, syzbot found the following issue on: HEAD commit:c5a13b33 kmsan: clang-format core git tree: https://github.com/google/kmsan.git master console output: https://syzkaller.appspot.com/x/log.txt?x=142cf80990 kernel config: https://syzkaller.appspot.com/x/.config?x=20f149ad694ba4be dashboard link: https://syzkaller.appspot.com/bug?extid=91f02b28f9bb5f5f1341 compiler: clang version 10.0.0 (https://github.com/llvm/llvm-project/ c2443155a0fb245c8f17f2c1c72b6ea391e86e81) userspace arch: i386 Unfortunately, I don't have any reproducer for this issue yet. IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+91f02b28f9bb5f5f1...@syzkaller.appspotmail.com UDF-fs: warning (device loop3): udf_load_vrs: No anchor found UDF-fs: Scanning with blocksize 512 failed UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2020/09/19 18:44 (1000) UDF-fs: error (device loop3): udf_read_inode: (ino 1328) failed !bh ===== BUG: KMSAN: uninit-value in udf_evict_inode+0x382/0x7d0 fs/udf/inode.c:150 CPU: 0 PID: 13956 Comm: syz-executor.3 Not tainted 5.9.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x21c/0x280 lib/dump_stack.c:118 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:122 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:219 udf_evict_inode+0x382/0x7d0 fs/udf/inode.c:150 evict+0x4d3/0xec0 fs/inode.c:576 iput_final fs/inode.c:1652 [inline] iput+0xc7b/0xf50 fs/inode.c:1678 iget_failed+0x2cb/0x390 fs/bad_inode.c:242 __udf_iget+0x111d/0x4650 fs/udf/inode.c:1914 udf_iget fs/udf/udfdecl.h:147 [inline] udf_fill_super+0x2fa3/0x3330 fs/udf/super.c:2284 mount_bdev+0x622/0x910 fs/super.c:1417 udf_mount+0xc9/0xe0 fs/udf/super.c:127 legacy_get_tree+0x163/0x2e0 fs/fs_context.c:592 vfs_get_tree+0xd8/0x5d0 fs/super.c:1547 do_new_mount fs/namespace.c:2875 [inline] path_mount+0x3d1a/0x5d40 fs/namespace.c:3192 do_mount+0x1c6/0x220 fs/namespace.c:3205 __do_compat_sys_mount fs/compat.c:122 [inline] __se_compat_sys_mount+0x7b5/0xaa0 fs/compat.c:89 __ia32_compat_sys_mount+0x62/0x80 fs/compat.c:89 do_syscall_32_irqs_on arch/x86/entry/common.c:80 [inline] __do_fast_syscall_32+0x129/0x180 arch/x86/entry/common.c:139 do_fast_syscall_32+0x6a/0xc0 arch/x86/entry/common.c:162 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:205 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c RIP: 0023:0xf7f94549 Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 RSP: 002b:f558df20 EFLAGS: 0292 ORIG_RAX: 0015 RAX: ffda RBX: f558df7c RCX: 2100 RDX: 2000 RSI: RDI: f558dfbc RBP: f558df7c R08: R09: R10: R11: R12: R13: R14: R15: Uninit was stored to memory at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:143 [inline] kmsan_internal_chain_origin+0xad/0x130 mm/kmsan/kmsan.c:311 __msan_chain_origin+0x50/0x90 mm/kmsan/kmsan_instr.c:169 udf_alloc_inode+0x2ab/0x2d0 fs/udf/super.c:154 alloc_inode fs/inode.c:232 [inline] iget_locked+0x37a/0x13f0 fs/inode.c:1193 __udf_iget+0x152/0x4650 fs/udf/inode.c:1902 udf_iget fs/udf/udfdecl.h:147 [inline] udf_fill_super+0x2fa3/0x3330 fs/udf/super.c:2284 mount_bdev+0x622/0x910 fs/super.c:1417 udf_mount+0xc9/0xe0 fs/udf/super.c:127 legacy_get_tree+0x163/0x2e0 fs/fs_context.c:592 vfs_get_tree+0xd8/0x5d0 fs/super.c:1547 do_new_mount fs/namespace.c:2875 [inline] path_mount+0x3d1a/0x5d40 fs/namespace.c:3192 do_mount+0x1c6/0x220 fs/namespace.c:3205 __do_compat_sys_mount fs/compat.c:122 [inline] __se_compat_sys_mount+0x7b5/0xaa0 fs/compat.c:89 __ia32_compat_sys_mount+0x62/0x80 fs/compat.c:89 do_syscall_32_irqs_on arch/x86/entry/common.c:80 [inline] __do_fast_syscall_32+0x129/0x180 arch/x86/entry/common.c:139 do_fast_syscall_32+0x6a/0xc0 arch/x86/entry/common.c:162 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:205 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c Uninit was created at: kmsan_save_stack_with_flags+0x3c/0x90 mm/kmsan/kmsan.c:143 kmsan_internal_alloc_meta_for_pages mm/kmsan/kmsan_shadow.c:268 [inline] kmsan_alloc_page+0xc5/0x1a0 mm/kmsan/kmsan_shadow.c:292 __alloc_pages_nodemask+0xf34/0x1120 mm/page_alloc.c:4927 alloc_pages_current+0x685/0xb50 mm/mempolicy.c:2275 alloc_pages include/linux/gfp.h:545 [inline] alloc_slab_page mm/slub.c:1634 [inline] allocate_slab+0x2fe/0x1180 mm/slub.c:1777 new_slab mm/slub.c:1838 [inline] new_slab_objects mm/slub.c:2595 [inline] ___slab_alloc+0xd65/0x1940 mm/slub.c:2756 __slab_alloc mm/slub.c:2796 [inline
