linux-kernel - KMSAN: uninit-value in sr_check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Sat, 11 Feb 2023 23:39:37 -0800
From:   Dipanjan Das <mail.dipanjan.das@...il.com>
To:     jejb@...ux.ibm.com, martin.petersen@...cle.com,
        linux-scsi@...r.kernel.org,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Cc:     syzkaller <syzkaller@...glegroups.com>,
        Marius Fleischer <fleischermarius@...glemail.com>,
        Priyanka Bose <its.priyanka.bose@...il.com>
Subject: KMSAN: uninit-value in sr_check_events

Hi,

We would like to report the following bug which has been found by our
modified version of syzkaller.

======================================================
description: KMSAN: uninit-value in sr_check_events
affected file: drivers/scsi/sr.c
kernel version: 6.2.0-rc5
kernel commit: 41c66f47061608dc1fd493eebce198f0e74cc2d7
git tree: kmsan
kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=a9a22da1efde3af6
crash reproducer: attached
======================================================
Crash log:
======================================================
BUG: KMSAN: uninit-value in sr_check_events+0x12d2/0x13c0 drivers/scsi/sr.c:269
 sr_check_events+0x12d2/0x13c0 drivers/scsi/sr.c:269
 cdrom_update_events drivers/cdrom/cdrom.c:1485 [inline]
 cdrom_check_events+0x61/0x170 drivers/cdrom/cdrom.c:1495
 sr_block_check_events+0xf5/0x130 drivers/scsi/sr.c:559
 disk_check_events+0xf1/0x950 block/disk-events.c:193
 disk_clear_events block/disk-events.c:248 [inline]
 bdev_check_media_change+0x26a/0x7f0 block/disk-events.c:279
 sr_block_open+0x159/0x340 drivers/scsi/sr.c:494
 blkdev_get_whole+0xb4/0x700 block/bdev.c:672
 blkdev_get_by_dev+0x4c9/0x1280 block/bdev.c:822
 blkdev_open+0x216/0x440 block/fops.c:478
 do_dentry_open+0xf85/0x1970 fs/open.c:882
 vfs_open+0x75/0xa0 fs/open.c:1013
 do_open fs/namei.c:3557 [inline]
 path_openat+0x4c4b/0x5a00 fs/namei.c:3714
 do_filp_open+0x252/0x660 fs/namei.c:3741
 do_sys_openat2+0x200/0x920 fs/open.c:1310
 do_sys_open fs/open.c:1326 [inline]
 __do_sys_openat fs/open.c:1342 [inline]
 __se_sys_openat fs/open.c:1337 [inline]
 __x64_sys_openat+0x285/0x310 fs/open.c:1337
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Uninit was stored to memory at:
 sr_check_events+0xb04/0x13c0 drivers/scsi/sr.c:216
 cdrom_update_events drivers/cdrom/cdrom.c:1485 [inline]
 cdrom_check_events+0x61/0x170 drivers/cdrom/cdrom.c:1495
 sr_block_check_events+0xf5/0x130 drivers/scsi/sr.c:559
 disk_check_events+0xf1/0x950 block/disk-events.c:193
 disk_clear_events block/disk-events.c:248 [inline]
 bdev_check_media_change+0x26a/0x7f0 block/disk-events.c:279
 sr_block_open+0x159/0x340 drivers/scsi/sr.c:494
 blkdev_get_whole+0xb4/0x700 block/bdev.c:672
 blkdev_get_by_dev+0x4c9/0x1280 block/bdev.c:822
 blkdev_open+0x216/0x440 block/fops.c:478
 do_dentry_open+0xf85/0x1970 fs/open.c:882
 vfs_open+0x75/0xa0 fs/open.c:1013
 do_open fs/namei.c:3557 [inline]
 path_openat+0x4c4b/0x5a00 fs/namei.c:3714
 do_filp_open+0x252/0x660 fs/namei.c:3741
 do_sys_openat2+0x200/0x920 fs/open.c:1310
 do_sys_open fs/open.c:1326 [inline]
 __do_sys_openat fs/open.c:1342 [inline]
 __se_sys_openat fs/open.c:1337 [inline]
 __x64_sys_openat+0x285/0x310 fs/open.c:1337
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Local variable sshdr.i created at:
 sr_get_events drivers/scsi/sr.c:172 [inline]
 sr_check_events+0x11f/0x13c0 drivers/scsi/sr.c:215
 cdrom_update_events drivers/cdrom/cdrom.c:1485 [inline]
 cdrom_check_events+0x61/0x170 drivers/cdrom/cdrom.c:1495

CPU: 0 PID: 22994 Comm: syz-executor.1 Not tainted
6.2.0-rc5-00010-g41c66f470616 #8
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014

-- 
Thanks and Regards,

Dipanjan

Download attachment "repro.syz" of type "application/octet-stream" (77 bytes)

View attachment "repro.c" of type "text/x-csrc" (3812 bytes)