linux-kernel - KMSAN: uninit-value in generic_bin

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CANX2M5afTSPn_UdRhYkBcvfm2feJS_eY+C+A49fEQD8evvsVjw@mail.gmail.com>
Date:   Fri, 17 Feb 2023 22:02:36 -0800
From:   Dipanjan Das <mail.dipanjan.das@...il.com>
To:     clm@...com, josef@...icpanda.com, dsterba@...e.com,
        linux-btrfs@...r.kernel.org,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Cc:     syzkaller <syzkaller@...glegroups.com>,
        Marius Fleischer <fleischermarius@...glemail.com>,
        Priyanka Bose <its.priyanka.bose@...il.com>
Subject: KMSAN: uninit-value in generic_bin_search

Hi,

We would like to report the following bug which has been found by our
modified version of syzkaller.

======================================================
description: KMSAN: uninit-value in generic_bin_search
affected file: fs/btrfs/ctree.c
kernel version: 6.2.0-rc5
kernel commit: 41c66f47061608dc1fd493eebce198f0e74cc2d7
git tree: kmsan
kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=a9a22da1efde3af6
crash reproducer: attached
======================================================
Crash log:
======================================================
BUG: KMSAN: uninit-value in btrfs_comp_cpu_keys fs/btrfs/ctree.c:753 [inline]
BUG: KMSAN: uninit-value in comp_keys fs/btrfs/ctree.c:729 [inline]
BUG: KMSAN: uninit-value in generic_bin_search+0x709/0xc20 fs/btrfs/ctree.c:913
 btrfs_comp_cpu_keys fs/btrfs/ctree.c:753 [inline]
 comp_keys fs/btrfs/ctree.c:729 [inline]
 generic_bin_search+0x709/0xc20 fs/btrfs/ctree.c:913
 search_for_key_slot fs/btrfs/ctree.c:1872 [inline]
 search_leaf fs/btrfs/ctree.c:1964 [inline]
 btrfs_search_slot+0x3ebc/0x4850 fs/btrfs/ctree.c:2177
 update_dev_stat_item fs/btrfs/volumes.c:7648 [inline]
 btrfs_run_dev_stats+0x3b7/0x17d0 fs/btrfs/volumes.c:7725
 commit_cowonly_roots+0x350/0x1120 fs/btrfs/transaction.c:1288
 btrfs_commit_transaction+0x22b0/0x6980 fs/btrfs/transaction.c:2398
 btrfs_commit_super+0x136/0x180 fs/btrfs/disk-io.c:4604
 close_ctree+0x3e5/0x14e0 fs/btrfs/disk-io.c:4758
 btrfs_put_super+0x38/0x50 fs/btrfs/super.c:81
 generic_shutdown_super+0x1c5/0x520 fs/super.c:492
 kill_anon_super+0x33/0x70 fs/super.c:1086
 btrfs_kill_super+0x39/0x60 fs/btrfs/super.c:2132
 deactivate_locked_super+0xbd/0x140 fs/super.c:332
 deactivate_super+0x151/0x160 fs/super.c:363
 cleanup_mnt+0x6b1/0x720 fs/namespace.c:1291
 __cleanup_mnt+0x1e/0x30 fs/namespace.c:1298
 task_work_run+0x236/0x2d0 kernel/task_work.c:179
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 exit_to_user_mode_loop+0x2a7/0x320 kernel/entry/common.c:171
 exit_to_user_mode_prepare+0x172/0x230 kernel/entry/common.c:203
 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline]
 syscall_exit_to_user_mode+0x27/0x140 kernel/entry/common.c:296
 do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Uninit was created at:
 __alloc_pages+0x767/0xee0 mm/page_alloc.c:5572
 alloc_pages+0xa9a/0xd90 mm/mempolicy.c:2286
 folio_alloc+0x41/0x100 mm/mempolicy.c:2296
 filemap_alloc_folio+0xa5/0x450 mm/filemap.c:972
 __filemap_get_folio+0xe7c/0x1960 mm/filemap.c:1966
 pagecache_get_page+0x46/0x270 mm/folio-compat.c:98
 find_or_create_page include/linux/pagemap.h:612 [inline]
 alloc_extent_buffer+0x6b8/0x3000 fs/btrfs/extent_io.c:4498
 btrfs_find_create_tree_block+0x40/0x50 fs/btrfs/disk-io.c:1002
 btrfs_init_new_buffer fs/btrfs/extent-tree.c:4873 [inline]
 btrfs_alloc_tree_block+0x361/0x2020 fs/btrfs/extent-tree.c:4992
 __btrfs_cow_block+0x557/0x1f60 fs/btrfs/ctree.c:541
 btrfs_cow_block+0x75c/0xa10 fs/btrfs/ctree.c:696
 btrfs_search_slot+0x1727/0x4850 fs/btrfs/ctree.c:2141
 update_dev_stat_item fs/btrfs/volumes.c:7648 [inline]
 btrfs_run_dev_stats+0x3b7/0x17d0 fs/btrfs/volumes.c:7725
 commit_cowonly_roots+0x350/0x1120 fs/btrfs/transaction.c:1288
 btrfs_commit_transaction+0x22b0/0x6980 fs/btrfs/transaction.c:2398
 btrfs_commit_super+0x136/0x180 fs/btrfs/disk-io.c:4604
 close_ctree+0x3e5/0x14e0 fs/btrfs/disk-io.c:4758
 btrfs_put_super+0x38/0x50 fs/btrfs/super.c:81
 generic_shutdown_super+0x1c5/0x520 fs/super.c:492
 kill_anon_super+0x33/0x70 fs/super.c:1086
 btrfs_kill_super+0x39/0x60 fs/btrfs/super.c:2132
 deactivate_locked_super+0xbd/0x140 fs/super.c:332
 deactivate_super+0x151/0x160 fs/super.c:363
 cleanup_mnt+0x6b1/0x720 fs/namespace.c:1291
 __cleanup_mnt+0x1e/0x30 fs/namespace.c:1298
 task_work_run+0x236/0x2d0 kernel/task_work.c:179
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 exit_to_user_mode_loop+0x2a7/0x320 kernel/entry/common.c:171
 exit_to_user_mode_prepare+0x172/0x230 kernel/entry/common.c:203
 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline]
 syscall_exit_to_user_mode+0x27/0x140 kernel/entry/common.c:296
 do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

CPU: 0 PID: 8513 Comm: syz-executor.0 Not tainted
6.2.0-rc5-00010-g41c66f470616 #8
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014

-- 
Thanks and Regards,

Dipanjan

View attachment "repro.c" of type "text/x-csrc" (57481 bytes)

Download attachment "repro.syz" of type "application/octet-stream" (23633 bytes)