linux-kernel - [syzbot] [hfs?] KMSAN: uninit-value in hfs_find_set_zero

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Mon, 06 Mar 2023 09:55:44 -0800
From:   syzbot <syzbot+773fa9d79b29bd8b6831@...kaller.appspotmail.com>
To:     glider@...gle.com, linux-fsdevel@...r.kernel.org,
        linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: [syzbot] [hfs?] KMSAN: uninit-value in hfs_find_set_zero_bits

Hello,

syzbot found the following issue on:

HEAD commit:    944070199c5e kmsan: add memsetXX tests
git tree:       https://github.com/google/kmsan.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=11241922c80000
kernel config:  https://syzkaller.appspot.com/x/.config?x=46c642641b9ef616
dashboard link: https://syzkaller.appspot.com/bug?extid=773fa9d79b29bd8b6831
compiler:       Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: i386
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=14254554c80000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=11f1ed74c80000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/4e9f6063c80b/disk-94407019.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/249a6496ae21/vmlinux-94407019.xz
kernel image: https://storage.googleapis.com/syzbot-assets/08b8d6e427f4/bzImage-94407019.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/5de3b0f6cccb/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+773fa9d79b29bd8b6831@...kaller.appspotmail.com

loop0: detected capacity change from 0 to 64
=====================================================
BUG: KMSAN: uninit-value in hfs_find_set_zero_bits+0x836/0xc90 fs/hfs/bitmap.c:45
 hfs_find_set_zero_bits+0x836/0xc90 fs/hfs/bitmap.c:45
 hfs_vbm_search_free+0x141/0x530 fs/hfs/bitmap.c:151
 hfs_extend_file+0x6fc/0x1bf0 fs/hfs/extent.c:408
 hfs_get_block+0x400/0x1020 fs/hfs/extent.c:353
 __block_write_begin_int+0x6b1/0x2670 fs/buffer.c:1991
 __block_write_begin fs/buffer.c:2041 [inline]
 block_write_begin+0x143/0x450 fs/buffer.c:2102
 cont_write_begin+0xa64/0xe60 fs/buffer.c:2456
 hfs_write_begin+0x9a/0x130 fs/hfs/inode.c:58
 generic_perform_write+0x3f5/0xbf0 mm/filemap.c:3773
 __generic_file_write_iter+0x393/0x920 mm/filemap.c:3901
 generic_file_write_iter+0x103/0x5b0 mm/filemap.c:3933
 call_write_iter include/linux/fs.h:2189 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x834/0x1580 fs/read_write.c:584
 ksys_write+0x21f/0x4f0 fs/read_write.c:637
 __do_sys_write fs/read_write.c:649 [inline]
 __se_sys_write fs/read_write.c:646 [inline]
 __ia32_sys_write+0x91/0xd0 fs/read_write.c:646
 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
 __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178
 do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203
 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246
 entry_SYSENTER_compat_after_hwframe+0x70/0x82

Uninit was created at:
 slab_post_alloc_hook+0x12d/0xb60 mm/slab.h:766
 slab_alloc_node mm/slub.c:3452 [inline]
 __kmem_cache_alloc_node+0x518/0x920 mm/slub.c:3491
 kmalloc_trace+0x51/0x200 mm/slab_common.c:1062
 kmalloc include/linux/slab.h:580 [inline]
 hfs_mdb_get+0x1c4e/0x29b0 fs/hfs/mdb.c:175
 hfs_fill_super+0x1d78/0x2460 fs/hfs/super.c:406
 mount_bdev+0x50e/0x840 fs/super.c:1359
 hfs_mount+0x4d/0x60 fs/hfs/super.c:456
 legacy_get_tree+0x110/0x290 fs/fs_context.c:610
 vfs_get_tree+0xa5/0x500 fs/super.c:1489
 do_new_mount+0x69a/0x1580 fs/namespace.c:3145
 path_mount+0x725/0x1ec0 fs/namespace.c:3475
 do_mount fs/namespace.c:3488 [inline]
 __do_sys_mount fs/namespace.c:3697 [inline]
 __se_sys_mount+0x734/0x840 fs/namespace.c:3674
 __ia32_sys_mount+0xe3/0x150 fs/namespace.c:3674
 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
 __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178
 do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203
 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246
 entry_SYSENTER_compat_after_hwframe+0x70/0x82

CPU: 1 PID: 5030 Comm: syz-executor199 Not tainted 6.2.0-syzkaller-81157-g944070199c5e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/16/2023
=====================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@...glegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches