linux-kernel - Re: [PATCH] kernel/sched: fix KMSAN uninit-value error

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <f16cd8cd-ce91-46a3-7180-855b762b34c0@bytedance.com>
Date:   Mon, 5 Sep 2022 14:41:44 +0800
From:   Chengming Zhou <zhouchengming@...edance.com>
To:     Bernard Zhao <bernard@...o.com>
Cc:     zhaojunkui2008@....com, Johannes Weiner <hannes@...xchg.org>,
        Suren Baghdasaryan <surenb@...gle.com>,
        Ingo Molnar <mingo@...hat.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Juri Lelli <juri.lelli@...hat.com>,
        Vincent Guittot <vincent.guittot@...aro.org>,
        Dietmar Eggemann <dietmar.eggemann@....com>,
        Steven Rostedt <rostedt@...dmis.org>,
        Ben Segall <bsegall@...gle.com>, Mel Gorman <mgorman@...e.de>,
        Daniel Bristot de Oliveira <bristot@...hat.com>,
        Valentin Schneider <vschneid@...hat.com>,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] kernel/sched: fix KMSAN uninit-value error

On 2022/9/5 10:37, Bernard Zhao wrote:
> This patch try to fix syzbot error:
> =====================================================
> BUG: KMSAN: uninit-value in update_triggers kernel/sched/psi.c:525 [inline]
> BUG: KMSAN: uninit-value in psi_poll_work kernel/sched/psi.c:626 [inline]
> BUG: KMSAN: uninit-value in psi_poll_worker+0x972/0x16a0 kernel/sched/psi.c:648

Hello,

Did you test with the latest PSI code using linux-next branch that include
the commit 2b97cf76289a ("sched/psi: Zero the memory of struct psi_group")?

Thanks.


>  update_triggers kernel/sched/psi.c:525 [inline]
>  psi_poll_work kernel/sched/psi.c:626 [inline]
>  psi_poll_worker+0x972/0x16a0 kernel/sched/psi.c:648
>  kthread+0x31b/0x430 kernel/kthread.c:376
>  ret_from_fork+0x1f/0x30
> 
> Uninit was stored to memory at:
>  collect_percpu_times+0x193d/0x19a0 kernel/sched/psi.c:355
>  psi_poll_work kernel/sched/psi.c:604 [inline]
>  psi_poll_worker+0x587/0x16a0 kernel/sched/psi.c:648
>  kthread+0x31b/0x430 kernel/kthread.c:376
>  ret_from_fork+0x1f/0x30
> 
> Uninit was stored to memory at:
>  collect_percpu_times+0x193d/0x19a0 kernel/sched/psi.c:355
>  psi_poll_work kernel/sched/psi.c:604 [inline]
>  psi_poll_worker+0x587/0x16a0 kernel/sched/psi.c:648
>  kthread+0x31b/0x430 kernel/kthread.c:376
>  ret_from_fork+0x1f/0x30
> 
> Uninit was stored to memory at:
>  collect_percpu_times+0x193d/0x19a0 kernel/sched/psi.c:355
>  psi_poll_work kernel/sched/psi.c:604 [inline]
>  psi_poll_worker+0x587/0x16a0 kernel/sched/psi.c:648
>  kthread+0x31b/0x430 kernel/kthread.c:376
>  ret_from_fork+0x1f/0x30
> 
> Uninit was created at:
>  slab_post_alloc_hook mm/slab.h:732 [inline]
>  slab_alloc_node mm/slub.c:3258 [inline]
>  slab_alloc mm/slub.c:3266 [inline]
>  kmem_cache_alloc_trace+0x696/0xdf0 mm/slub.c:3297
>  kmalloc include/linux/slab.h:600 [inline]
>  psi_cgroup_alloc+0x83/0x250 kernel/sched/psi.c:960
>  cgroup_create kernel/cgroup/cgroup.c:5430 [inline]
>  cgroup_mkdir+0x10a3/0x3080 kernel/cgroup/cgroup.c:5550
>  kernfs_iop_mkdir+0x2ba/0x520 fs/kernfs/dir.c:1185
>  vfs_mkdir+0x62a/0x870 fs/namei.c:4013
>  do_mkdirat+0x466/0x7b0 fs/namei.c:4038
>  __do_sys_mkdirat fs/namei.c:4053 [inline]
>  __se_sys_mkdirat fs/namei.c:4051 [inline]
>  __x64_sys_mkdirat+0xc4/0x120 fs/namei.c:4051
>  do_syscall_x64 arch/x86/entry/common.c:50 [inline]
>  do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
>  entry_SYSCALL_64_after_hwframe+0x63/0xcd
> 
> syzbot link:
> https://syzkaller.appspot.com/bug?id=d04c5407207d11e46007775517b97764174bc45d
> 
> Signed-off-by: Bernard Zhao <bernard@...o.com>
> ---
>  kernel/sched/psi.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c
> index ecb4b4ff4ce0..46f048121520 100644
> --- a/kernel/sched/psi.c
> +++ b/kernel/sched/psi.c
> @@ -195,6 +195,9 @@ static void group_init(struct psi_group *group)
>  	init_waitqueue_head(&group->poll_wait);
>  	timer_setup(&group->poll_timer, poll_timer_fn, 0);
>  	rcu_assign_pointer(group->poll_task, NULL);
> +	memset(group->avg_total, 0, sizeof(group->avg_total));
> +	memset(group->total, 0, sizeof(group->total));
> +	memset(group->avg, 0, sizeof(group->avg));
>  }
>  
>  void __init psi_init(void)