linux-kernel - Re: KMSAN: uninit-value in em_ret

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <ZZSXotY3NRbki_hW@google.com>
Date: Tue, 2 Jan 2024 15:09:22 -0800
From: Sean Christopherson <seanjc@...gle.com>
To: xingwei lee <xrivendell7@...il.com>
Cc: linux-kernel@...r.kernel.org, dave.hansen@...ux.intel.com, bp@...en8.de, 
	hpa@...or.com, kvm@...r.kernel.org, mingo@...hat.com, pbonzini@...hat.com, 
	Thomas Gleixner <tglx@...utronix.de>, x86@...nel.org
Subject: Re: KMSAN: uninit-value in em_ret_far

On Mon, Dec 25, 2023, xingwei lee wrote:
> Hello I found a bug in latest upstream 6.7-rc7 titled "KMSAN:
> uninit-value in em_ret_far” and maybe is realted with kvm.
> 
> If you fix this issue, please add the following tag to the commit:
> Reported-by: xingwei lee <xrivendell7@...il.com>
> 
> kernel: mainline 861deac3b092f37b2c5e6871732f3e11486f7082
> kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=4a65fa9f077ead01
> with KMSAN enabled
> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> run the repro.c for about 3minus and it crashed!
> 
> TITLE: KMSAN: uninit-value in em_ret_far
> =====================================================
> BUG: KMSAN: uninit-value in emulator_recalc_and_set_mode
> arch/x86/kvm/emulate.c:797 [inline]
> BUG: KMSAN: uninit-value in assign_eip_far arch/x86/kvm/emulate.c:833 [inline]
> BUG: KMSAN: uninit-value in em_ret_far+0x348/0x350 arch/x86/kvm/emulate.c:2258
> emulator_recalc_and_set_mode arch/x86/kvm/emulate.c:797 [inline]
> assign_eip_far arch/x86/kvm/emulate.c:833 [inline]

This is a known issue[1].  It's effectively a false positive, even though there
is technically uninitialized data in scope.  The proposed fix[2] from Julian
should resolve this (the patch is on my radar for 6.9).

[1] https://lore.kernel.org/all/9362077ac7f24ec684d338543e269e83aee7c897.camel@cyberus-technology.de
[2] https://lore.kernel.org/all/20231009092054.556935-1-julian.stecklina@cyberus-technology.de