Message-ID: <000000000000f1de5405d2ca4ae2@google.com>
Date:   Fri, 10 Dec 2021 04:59:26 -0800
From:   syzbot <syzbot+ce39644883793043ee77@...kaller.appspotmail.com>
To:     akpm@...ux-foundation.org, christian.brauner@...ntu.com,
        cxfcosmos@...il.com, ebiederm@...ssion.com, glider@...gle.com,
        legion@...nel.org, linux-kernel@...r.kernel.org, serge@...lyn.com,
        syzkaller-bugs@...glegroups.com
Subject: [syzbot] KMSAN: uninit-value in make_kuid

Hello,

syzbot found the following issue on:

HEAD commit:    b0f85c4ccdd4 kmsan: report: add dump_stack_print_info()
git tree:       https://github.com/google/kmsan.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=1704eaf9b00000
kernel config:  https://syzkaller.appspot.com/x/.config?x=e00a8959fdd3f3e8
dashboard link: https://syzkaller.appspot.com/bug?extid=ce39644883793043ee77
compiler:       clang version 14.0.0 (git@...hub.com:llvm/llvm-project.git 0996585c8e3b3d409494eb5f1cad714b9e1f7fb5), GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: i386

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ce39644883793043ee77@...kaller.appspotmail.com

=====================================================
BUG: KMSAN: uninit-value in map_id_range_down_base kernel/user_namespace.c:288 [inline]
BUG: KMSAN: uninit-value in map_id_range_down kernel/user_namespace.c:302 [inline]
BUG: KMSAN: uninit-value in map_id_down kernel/user_namespace.c:317 [inline]
BUG: KMSAN: uninit-value in make_kuid+0x450/0xc70 kernel/user_namespace.c:394
 map_id_range_down_base kernel/user_namespace.c:288 [inline]
 map_id_range_down kernel/user_namespace.c:302 [inline]
 map_id_down kernel/user_namespace.c:317 [inline]
 make_kuid+0x450/0xc70 kernel/user_namespace.c:394
 p9pdu_vreadf net/9p/protocol.c:167 [inline]
 p9pdu_readf+0x1378/0x4fc0 net/9p/protocol.c:526
 p9pdu_vreadf net/9p/protocol.c:312 [inline]
 p9pdu_readf+0x1cd0/0x4fc0 net/9p/protocol.c:526
 p9_client_getattr_dotl+0x2de/0x7f0 net/9p/client.c:1768
 v9fs_refresh_inode_dotl+0xb9/0x320 fs/9p/vfs_inode_dotl.c:958
 v9fs_lookup_revalidate+0x33d/0x440 fs/9p/vfs_dentry.c:85
 complete_walk+0x5a0/0x680 fs/namei.c:914
 path_lookupat+0x441/0x8a0 fs/namei.c:2456
 filename_lookup+0x66e/0xa50 fs/namei.c:2480
 user_path_at_empty+0x135/0x430 fs/namei.c:2801
 user_path_at include/linux/namei.h:57 [inline]
 do_mount fs/namespace.c:3328 [inline]
 __do_sys_mount fs/namespace.c:3539 [inline]
 __se_sys_mount+0x7f9/0xa10 fs/namespace.c:3516
 __ia32_sys_mount+0x157/0x1b0 fs/namespace.c:3516
 do_syscall_32_irqs_on arch/x86/entry/common.c:114 [inline]
 __do_fast_syscall_32+0x96/0xf0 arch/x86/entry/common.c:180
 do_fast_syscall_32+0x34/0x70 arch/x86/entry/common.c:205
 do_SYSENTER_32+0x1b/0x20 arch/x86/entry/common.c:248
 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c

Uninit was stored to memory at:
 pdu_read net/9p/protocol.c:48 [inline]
 p9pdu_vreadf net/9p/protocol.c:163 [inline]
 p9pdu_readf+0x1288/0x4fc0 net/9p/protocol.c:526
 p9pdu_vreadf net/9p/protocol.c:312 [inline]
 p9pdu_readf+0x1cd0/0x4fc0 net/9p/protocol.c:526
 p9_client_getattr_dotl+0x2de/0x7f0 net/9p/client.c:1768
 v9fs_refresh_inode_dotl+0xb9/0x320 fs/9p/vfs_inode_dotl.c:958
 v9fs_lookup_revalidate+0x33d/0x440 fs/9p/vfs_dentry.c:85
 complete_walk+0x5a0/0x680 fs/namei.c:914
 path_lookupat+0x441/0x8a0 fs/namei.c:2456
 filename_lookup+0x66e/0xa50 fs/namei.c:2480
 user_path_at_empty+0x135/0x430 fs/namei.c:2801
 user_path_at include/linux/namei.h:57 [inline]
 do_mount fs/namespace.c:3328 [inline]
 __do_sys_mount fs/namespace.c:3539 [inline]
 __se_sys_mount+0x7f9/0xa10 fs/namespace.c:3516
 __ia32_sys_mount+0x157/0x1b0 fs/namespace.c:3516
 do_syscall_32_irqs_on arch/x86/entry/common.c:114 [inline]
 __do_fast_syscall_32+0x96/0xf0 arch/x86/entry/common.c:180
 do_fast_syscall_32+0x34/0x70 arch/x86/entry/common.c:205
 do_SYSENTER_32+0x1b/0x20 arch/x86/entry/common.c:248
 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c

Uninit was stored to memory at:
 _copy_to_iter+0x1697/0x25c0 lib/iov_iter.c:670
 __copy_page_to_iter lib/iov_iter.c:858 [inline]
 copy_page_to_iter+0x18b7/0x2650 lib/iov_iter.c:883
 pipe_read+0x12ca/0x2380 fs/pipe.c:305
 __kernel_read+0xb34/0x1380 fs/read_write.c:439
 kernel_read+0x278/0x490 fs/read_write.c:457
 p9_fd_read net/9p/trans_fd.c:263 [inline]
 p9_read_work+0x456/0x1bf0 net/9p/trans_fd.c:298
 process_one_work+0xdc2/0x1820 kernel/workqueue.c:2298
 worker_thread+0x10f1/0x2290 kernel/workqueue.c:2445
 kthread+0x721/0x850 kernel/kthread.c:327
 ret_from_fork+0x1f/0x30

Uninit was stored to memory at:
 _copy_from_iter+0x15eb/0x2520 lib/iov_iter.c:770
 copy_page_from_iter+0x1302/0x1330 lib/iov_iter.c:908
 pipe_write+0x2b9c/0x2dd0 fs/pipe.c:466
 __kernel_write+0xb3e/0x1380 fs/read_write.c:535
 kernel_write+0x47c/0xa50 fs/read_write.c:564
 p9_fd_write net/9p/trans_fd.c:428 [inline]
 p9_write_work+0xa41/0x17a0 net/9p/trans_fd.c:479
 process_one_work+0xdc2/0x1820 kernel/workqueue.c:2298
 worker_thread+0x10f1/0x2290 kernel/workqueue.c:2445
 kthread+0x721/0x850 kernel/kthread.c:327
 ret_from_fork+0x1f/0x30

Uninit was stored to memory at:
 pdu_write net/9p/protocol.c:57 [inline]
 p9pdu_vwritef+0x3799/0x5120 net/9p/protocol.c:379
 p9pdu_writef+0x23a/0x280 net/9p/protocol.c:539
 p9pdu_vwritef+0x21f0/0x5120 net/9p/protocol.c:490
 p9_client_prepare_req+0x9e3/0x1090 net/9p/client.c:703
 p9_client_rpc+0x276/0x1460 net/9p/client.c:734
 p9_client_setattr+0x115/0x2c0 net/9p/client.c:1894
 v9fs_vfs_setattr_dotl+0x7e2/0xd70 fs/9p/vfs_inode_dotl.c:588
 notify_change+0x1fe3/0x2170 fs/attr.c:410
 chown_common+0x84e/0xca0 fs/open.c:678
 do_fchownat+0x2f8/0x500 fs/open.c:709
 ksys_lchown include/linux/syscalls.h:1335 [inline]
 __do_sys_lchown16 kernel/uid16.c:30 [inline]
 __se_sys_lchown16 kernel/uid16.c:28 [inline]
 __ia32_sys_lchown16+0x200/0x250 kernel/uid16.c:28
 do_syscall_32_irqs_on arch/x86/entry/common.c:114 [inline]
 __do_fast_syscall_32+0x96/0xf0 arch/x86/entry/common.c:180
 do_fast_syscall_32+0x34/0x70 arch/x86/entry/common.c:205
 do_SYSENTER_32+0x1b/0x20 arch/x86/entry/common.c:248
 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c

Uninit was stored to memory at:
 p9pdu_vwritef+0x3d7f/0x5120 net/9p/protocol.c:378
 p9pdu_writef+0x23a/0x280 net/9p/protocol.c:539
 p9pdu_vwritef+0x21f0/0x5120 net/9p/protocol.c:490
 p9_client_prepare_req+0x9e3/0x1090 net/9p/client.c:703
 p9_client_rpc+0x276/0x1460 net/9p/client.c:734
 p9_client_setattr+0x115/0x2c0 net/9p/client.c:1894
 v9fs_vfs_setattr_dotl+0x7e2/0xd70 fs/9p/vfs_inode_dotl.c:588
 notify_change+0x1fe3/0x2170 fs/attr.c:410
 chown_common+0x84e/0xca0 fs/open.c:678
 do_fchownat+0x2f8/0x500 fs/open.c:709
 ksys_lchown include/linux/syscalls.h:1335 [inline]
 __do_sys_lchown16 kernel/uid16.c:30 [inline]
 __se_sys_lchown16 kernel/uid16.c:28 [inline]
 __ia32_sys_lchown16+0x200/0x250 kernel/uid16.c:28
 do_syscall_32_irqs_on arch/x86/entry/common.c:114 [inline]
 __do_fast_syscall_32+0x96/0xf0 arch/x86/entry/common.c:180
 do_fast_syscall_32+0x34/0x70 arch/x86/entry/common.c:205
 do_SYSENTER_32+0x1b/0x20 arch/x86/entry/common.c:248
 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c

Uninit was stored to memory at:
 v9fs_vfs_setattr_dotl+0x5c8/0xd70 fs/9p/vfs_inode_dotl.c:567
 notify_change+0x1fe3/0x2170 fs/attr.c:410
 chown_common+0x84e/0xca0 fs/open.c:678
 do_fchownat+0x2f8/0x500 fs/open.c:709
 ksys_lchown include/linux/syscalls.h:1335 [inline]
 __do_sys_lchown16 kernel/uid16.c:30 [inline]
 __se_sys_lchown16 kernel/uid16.c:28 [inline]
 __ia32_sys_lchown16+0x200/0x250 kernel/uid16.c:28
 do_syscall_32_irqs_on arch/x86/entry/common.c:114 [inline]
 __do_fast_syscall_32+0x96/0xf0 arch/x86/entry/common.c:180
 do_fast_syscall_32+0x34/0x70 arch/x86/entry/common.c:205
 do_SYSENTER_32+0x1b/0x20 arch/x86/entry/common.c:248
 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c

Local variable newattrs created at:
 chown_common+0x120/0xca0 fs/open.c:647
 do_fchownat+0x2f8/0x500 fs/open.c:709

CPU: 0 PID: 15704 Comm: syz-executor.2 Not tainted 5.16.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
=====================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@...glegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

Powered by blists - more mailing lists