linux-kernel - [syzbot] KMSAN: uninit-value in ondemand

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <0000000000007dcc0b05e91943c2@google.com>
Date:   Tue, 20 Sep 2022 03:26:39 -0700
From:   syzbot <syzbot+8ce7f8308d91e6b8bbe2@...kaller.appspotmail.com>
To:     akpm@...ux-foundation.org, glider@...gle.com,
        linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
        linux-mm@...ck.org, syzkaller-bugs@...glegroups.com,
        willy@...radead.org
Subject: [syzbot] KMSAN: uninit-value in ondemand_readahead

Hello,

syzbot found the following issue on:

HEAD commit:    8f4ae27df775 Revert "Revert "crypto: kmsan: disable accele..
git tree:       https://github.com/google/kmsan.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=10b5e0f8880000
kernel config:  https://syzkaller.appspot.com/x/.config?x=121c7ef28ec597bd
dashboard link: https://syzkaller.appspot.com/bug?extid=8ce7f8308d91e6b8bbe2
compiler:       clang version 15.0.0 (https://github.com/llvm/llvm-project.git 610139d2d9ce6746b3c617fb3e2f7886272d26ff), GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: i386

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/4cf4e5a58eb8/disk-8f4ae27d.raw.xz
vmlinux: https://storage.googleapis.com/82e5fbbe1600/vmlinux-8f4ae27d.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8ce7f8308d91e6b8bbe2@...kaller.appspotmail.com

=====================================================
BUG: KMSAN: uninit-value in ondemand_readahead+0x9de/0x1930 mm/readahead.c:586
 ondemand_readahead+0x9de/0x1930 mm/readahead.c:586
 page_cache_sync_ra+0x733/0x770 mm/readahead.c:699
 page_cache_sync_readahead include/linux/pagemap.h:1215 [inline]
 cramfs_blkdev_read+0x5fb/0x12b0 fs/cramfs/inode.c:217
 cramfs_read fs/cramfs/inode.c:278 [inline]
 cramfs_read_folio+0x21e/0x11e0 fs/cramfs/inode.c:827
 read_pages+0x1217/0x16b0 mm/readahead.c:178
 page_cache_ra_unbounded+0x7bf/0x880 mm/readahead.c:263
 do_page_cache_ra mm/readahead.c:293 [inline]
 page_cache_ra_order+0xf50/0x1000 mm/readahead.c:550
 ondemand_readahead+0x10f3/0x1930 mm/readahead.c:672
 page_cache_sync_ra+0x733/0x770 mm/readahead.c:699
 page_cache_sync_readahead include/linux/pagemap.h:1215 [inline]
 filemap_get_pages mm/filemap.c:2566 [inline]
 filemap_read+0xa07/0x3f80 mm/filemap.c:2660
 generic_file_read_iter+0x128/0xaa0 mm/filemap.c:2806
 __kernel_read+0x3c1/0xaa0 fs/read_write.c:428
 integrity_kernel_read+0x80/0xb0 security/integrity/iint.c:199
 ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:485 [inline]
 ima_calc_file_shash security/integrity/ima/ima_crypto.c:516 [inline]
 ima_calc_file_hash+0x18b6/0x3e30 security/integrity/ima/ima_crypto.c:573
 ima_collect_measurement+0x42f/0xb50 security/integrity/ima/ima_api.c:292
 process_measurement+0x208a/0x3680 security/integrity/ima/ima_main.c:337
 ima_file_check+0xbc/0x120 security/integrity/ima/ima_main.c:517
 do_open fs/namei.c:3559 [inline]
 path_openat+0x497c/0x5600 fs/namei.c:3691
 do_filp_open+0x249/0x660 fs/namei.c:3718
 do_sys_openat2+0x1f0/0x910 fs/open.c:1311
 do_sys_open fs/open.c:1327 [inline]
 __do_compat_sys_openat fs/open.c:1387 [inline]
 __se_compat_sys_openat fs/open.c:1385 [inline]
 __ia32_compat_sys_openat+0x2a7/0x330 fs/open.c:1385
 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
 __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178
 do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:203
 do_SYSENTER_32+0x1b/0x20 arch/x86/entry/common.c:246
 entry_SYSENTER_compat_after_hwframe+0x70/0x82

Local variable ra created at:
 cramfs_blkdev_read+0xbe/0x12b0 fs/cramfs/inode.c:186
 cramfs_read fs/cramfs/inode.c:278 [inline]
 cramfs_read_folio+0x21e/0x11e0 fs/cramfs/inode.c:827

CPU: 0 PID: 4115 Comm: syz-executor.2 Not tainted 6.0.0-rc5-syzkaller-48538-g8f4ae27df775 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022
=====================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@...glegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.