| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <00000000000095ffe20613777eb5@google.com>
Date: Tue, 12 Mar 2024 07:30:06 -0700
From: syzbot <syzbot+2ef3a8ce8e91b5a50098@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org, syoshida@...hat.com,
syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [net?] KMSAN: uninit-value in hsr_get_node (2)
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
T1] usbhid: USB HID core driver
[ 41.445057][ T1] usbcore: registered new interface driver es2_ap_driver
[ 41.452522][ T1] comedi: version 0.7.76 - http://www.comedi.org
[ 41.462013][ T1] usbcore: registered new interface driver dt9812
[ 41.470508][ T1] usbcore: registered new interface driver ni6501
[ 41.478004][ T1] usbcore: registered new interface driver usbdux
[ 41.485497][ T1] usbcore: registered new interface driver usbduxfast
[ 41.493272][ T1] usbcore: registered new interface driver usbduxsigma
[ 41.501230][ T1] usbcore: registered new interface driver vmk80xx
[ 41.509250][ T1] usbcore: registered new interface driver prism2_usb
[ 41.518077][ T1] usbcore: registered new interface driver r8712u
[ 41.525021][ T1] greybus: registered new driver hid
[ 41.531212][ T1] greybus: registered new driver gbphy
[ 41.537142][ T1] gb_gbphy: registered new driver usb
[ 41.542897][ T1] asus_wmi: ASUS WMI generic driver loaded
[ 41.738826][ T1] usbcore: registered new interface driver snd-usb-audio
[ 41.747671][ T1] usbcore: registered new interface driver snd-ua101
[ 41.756259][ T1] usbcore: registered new interface driver snd-usb-usx2y
[ 41.764396][ T1] usbcore: registered new interface driver snd-usb-us122l
[ 41.772587][ T1] usbcore: registered new interface driver snd-usb-caiaq
[ 41.781306][ T1] usbcore: registered new interface driver snd-usb-6fire
[ 41.790406][ T1] usbcore: registered new interface driver snd-usb-hiface
[ 41.799287][ T1] usbcore: registered new interface driver snd-bcd2000
[ 41.807204][ T1] usbcore: registered new interface driver snd_usb_pod
[ 41.815236][ T1] usbcore: registered new interface driver snd_usb_podhd
[ 41.823341][ T1] usbcore: registered new interface driver snd_usb_toneport
[ 41.831585][ T1] usbcore: registered new interface driver snd_usb_variax
[ 41.839634][ T1] drop_monitor: Initializing network drop monitor service
[ 41.848496][ T1] NET: Registered PF_LLC protocol family
[ 41.854636][ T1] GACT probability on
[ 41.858817][ T1] Mirror/redirect action on
[ 41.863972][ T1] Simple TC action Loaded
[ 41.876090][ T1] netem: version 1.3
[ 41.880422][ T1] u32 classifier
[ 41.884012][ T1] Performance counters on
[ 41.890459][ T1] input device check on
[ 41.895664][ T1] Actions configured
[ 41.921296][ T1] nf_conntrack_irc: failed to register helpers
[ 41.928588][ T1] nf_conntrack_sane: failed to register helpers
[ 42.073937][ T1] nf_conntrack_sip: failed to register helpers
[ 42.090482][ T1] xt_time: kernel timezone is -0000
[ 42.096261][ T1] IPVS: Registered protocols (TCP, UDP, SCTP, AH, ESP)
[ 42.103352][ T1] IPVS: Connection hash table configured (size=4096, memory=32Kbytes)
[ 42.113694][ T1] IPVS: ipvs loaded.
[ 42.117739][ T1] IPVS: [rr] scheduler registered.
[ 42.122901][ T1] IPVS: [wrr] scheduler registered.
[ 42.128228][ T1] IPVS: [lc] scheduler registered.
[ 42.133405][ T1] IPVS: [wlc] scheduler registered.
[ 42.138759][ T1] IPVS: [fo] scheduler registered.
[ 42.143924][ T1] IPVS: [ovf] scheduler registered.
[ 42.149391][ T1] IPVS: [lblc] scheduler registered.
[ 42.154820][ T1] IPVS: [lblcr] scheduler registered.
[ 42.160239][ T1] IPVS: [dh] scheduler registered.
[ 42.165456][ T1] IPVS: [sh] scheduler registered.
[ 42.170640][ T1] IPVS: [mh] scheduler registered.
[ 42.175915][ T1] IPVS: [sed] scheduler registered.
[ 42.181264][ T1] IPVS: [nq] scheduler registered.
[ 42.186471][ T1] IPVS: [twos] scheduler registered.
[ 42.191914][ T1] IPVS: [sip] pe registered.
[ 42.198686][ T1] ipip: IPv4 and MPLS over IPv4 tunneling driver
[ 42.213107][ T1] gre: GRE over IPv4 demultiplexor driver
[ 42.219041][ T1] ip_gre: GRE over IPv4 tunneling driver
[ 42.246435][ T1] IPv4 over IPsec tunneling driver
[ 42.260657][ T1] Initializing XFRM netlink socket
[ 42.268642][ T1] IPsec XFRM device driver
[ 42.275059][ T1] NET: Registered PF_INET6 protocol family
[ 42.326632][ T1] Segment Routing with IPv6
[ 42.331207][ T1] RPL Segment Routing with IPv6
[ 42.337084][ T1] In-situ OAM (IOAM) with IPv6
[ 42.342955][ T1] mip6: Mobile IPv6
[ 42.351543][ T1] =====================================================
[ 42.351775][ T1] BUG: KMSAN: use-after-free in __list_add_valid_or_report+0xeb/0x2c0
[ 42.351917][ T1] __list_add_valid_or_report+0xeb/0x2c0
[ 42.352049][ T1] stack_depot_save_flags+0x554/0x6a0
[ 42.352178][ T1] stack_depot_save+0x12/0x20
[ 42.352283][ T1] ref_tracker_alloc+0x215/0x700
[ 42.352396][ T1] net_rx_queue_update_kobjects+0x1eb/0xa80
[ 42.352510][ T1] netdev_register_kobject+0x30e/0x530
[ 42.352609][ T1] register_netdevice+0x1995/0x2180
[ 42.352703][ T1] register_netdev+0xa5/0xe0
[ 42.352791][ T1] vti6_init_net+0x3f9/0x6a0
[ 42.352910][ T1] ops_init+0x30c/0x880
[ 42.352973][ T1] register_pernet_operations+0x523/0xa00
[ 42.353034][ T1] register_pernet_device+0x4f/0x180
[ 42.353092][ T1] vti6_tunnel_init+0x34/0x450
[ 42.353185][ T1] do_one_initcall+0x219/0x970
[ 42.353263][ T1] do_initcall_level+0x140/0x350
[ 42.353346][ T1] do_initcalls+0xf0/0x1e0
[ 42.353418][ T1] do_basic_setup+0x22/0x30
[ 42.353491][ T1] kernel_init_freeable+0x30b/0x4c0
[ 42.353569][ T1] kernel_init+0x2f/0x7e0
[ 42.353651][ T1] ret_from_fork+0x6d/0x90
[ 42.353723][ T1] ret_from_fork_asm+0x1a/0x30
[ 42.353801][ T1]
[ 42.353811][ T1] Uninit was created at:
[ 42.353928][ T1] free_unref_page_prepare+0xc1/0xad0
[ 42.354016][ T1] free_unref_page+0x59/0x730
[ 42.354119][ T1] destroy_large_folio+0x12a/0x1d0
[ 42.354239][ T1] __folio_put_large+0x101/0x110
[ 42.354353][ T1] __folio_put+0x153/0x160
[ 42.354441][ T1] free_large_kmalloc+0x167/0x210
[ 42.354529][ T1] kfree+0x4e3/0xa40
[ 42.354605][ T1] kmsan_vmap_pages_range_noflush+0x347/0x3d0
[ 42.354702][ T1] __vmalloc_node_range+0x217c/0x28c0
[ 42.354772][ T1] vmalloc_huge+0x92/0xb0
[ 42.354834][ T1] alloc_large_system_hash+0x459/0xa30
[ 42.354904][ T1] dcache_init+0x125/0x220
[ 42.354980][ T1] vfs_caches_init+0x7c/0xd0
[ 42.355056][ T1] start_kernel+0x8d8/0xa60
[ 42.355125][ T1] x86_64_start_reservations+0x2e/0x30
[ 42.355190][ T1] x86_64_start_kernel+0x98/0xa0
[ 42.355280][ T1] secondary_startup_64_no_verify+0x15f/0x16b
[ 42.355364][ T1]
[ 42.355375][ T1] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.8.0-syzkaller-01185-g855684c7d938-dirty #0
[ 42.355437][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
[ 42.355469][ T1] =====================================================
[ 42.355485][ T1] Disabling lock debugging due to kernel taint
[ 42.355505][ T1] Kernel panic - not syncing: kmsan.panic set ...
[ 42.355529][ T1] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G B 6.8.0-syzkaller-01185-g855684c7d938-dirty #0
[ 42.355590][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
[ 42.355621][ T1] Call Trace:
[ 42.355640][ T1] <TASK>
[ 42.355659][ T1] dump_stack_lvl+0x1bf/0x240
[ 42.355746][ T1] dump_stack+0x1e/0x30
[ 42.355818][ T1] panic+0x4e2/0xcc0
[ 42.355896][ T1] ? kmsan_get_metadata+0x121/0x1c0
[ 42.355998][ T1] kmsan_report+0x2d5/0x2e0
[ 42.356087][ T1] ? kmsan_get_metadata+0x146/0x1c0
[ 42.356181][ T1] ? kmsan_get_shadow_origin_ptr+0x4d/0xa0
[ 42.356276][ T1] ? kmsan_get_metadata+0x146/0x1c0
[ 42.356363][ T1] ? __msan_warning+0x95/0x110
[ 42.356442][ T1] ? __list_add_valid_or_report+0xeb/0x2c0
[ 42.356539][ T1] ? stack_depot_save_flags+0x554/0x6a0
[ 42.356620][ T1] ? stack_depot_save+0x12/0x20
[ 42.356694][ T1] ? ref_tracker_alloc+0x215/0x700
[ 42.356772][ T1] ? net_rx_queue_update_kobjects+0x1eb/0xa80
[ 42.356846][ T1] ? netdev_register_kobject+0x30e/0x530
[ 42.356916][ T1] ? register_netdevice+0x1995/0x2180
[ 42.356973][ T1] ? register_netdev+0xa5/0xe0
[ 42.356973][ T1] ? vti6_init_net+0x3f9/0x6a0
[ 42.356973][ T1] ? ops_init+0x30c/0x880
[ 42.356973][ T1] ? register_pernet_operations+0x523/0xa00
[ 42.356973][ T1] ? register_pernet_device+0x4f/0x180
[ 42.356973][ T1] ? vti6_tunnel_init+0x34/0x450
[ 42.356973][ T1] ? do_one_initcall+0x219/0x970
[ 42.356973][ T1] ? do_initcall_level+0x140/0x350
[ 42.356973][ T1] ? do_initcalls+0xf0/0x1e0
[ 42.356973][ T1] ? do_basic_setup+0x22/0x30
[ 42.356973][ T1] ? kernel_init_freeable+0x30b/0x4c0
[ 42.356973][ T1] ? kernel_init+0x2f/0x7e0
[ 42.356973][ T1] ? ret_from_fork+0x6d/0x90
[ 42.356973][ T1] ? ret_from_fork_asm+0x1a/0x30
[ 42.356973][ T1] ? kmsan_get_metadata+0x146/0x1c0
[ 42.356973][ T1] ? kmsan_get_shadow_origin_ptr+0x4d/0xa0
[ 42.356973][ T1] ? _raw_spin_lock_irqsave+0x35/0xc0
[ 42.356973][ T1] ? filter_irq_stacks+0x60/0x1a0
[ 42.356973][ T1] ? stack_depot_save_flags+0x2c/0x6a0
[ 42.356973][ T1] ? kmsan_get_metadata+0x146/0x1c0
[ 42.356973][ T1] ? kmsan_get_metadata+0x146/0x1c0
[ 42.356973][ T1] ? kmsan_get_metadata+0x146/0x1c0
[ 42.356973][ T1] ? kmsan_get_shadow_origin_ptr+0x4d/0xa0
[ 42.356973][ T1] __msan_warning+0x95/0x110
[ 42.356973][ T1] __list_add_valid_or_report+0xeb/0x2c0
[ 42.356973][ T1] stack_depot_save_flags+0x554/0x6a0
[ 42.356973][ T1] stack_depot_save+0x12/0x20
[ 42.356973][ T1] ref_tracker_alloc+0x215/0x700
[ 42.356973][ T1] ? dev_uevent_filter+0x53/0x110
[ 42.356973][ T1] ? net_rx_queue_update_kobjects+0x1eb/0xa80
[ 42.356973][ T1] ? netdev_register_kobject+0x30e/0x530
[ 42.356973][ T1] ? register_netdevice+0x1995/0x2180
[ 42.356973][ T1] ? register_netdev+0xa5/0xe0
[ 42.356973][ T1] ? vti6_init_net+0x3f9/0x6a0
[ 42.356973][ T1] ? ops_init+0x30c/0x880
[ 42.356973][ T1] ? register_pernet_operations+0x523/0xa00
[ 42.356973][ T1] ? register_pernet_device+0x4f/0x180
[ 42.356973][ T1] ? vti6_tunnel_init+0x34/0x450
[ 42.356973][ T1] ? do_one_initcall+0x219/0x970
[ 42.356973][ T1] ? do_initcall_level+0x140/0x350
[ 42.356973][ T1] ? do_initcalls+0xf0/0x1e0
[ 42.356973][ T1] ? do_basic_setup+0x22/0x30
[ 42.356973][ T1] ? kernel_init_freeable+0x30b/0x4c0
[ 42.356973][ T1] ? kernel_init+0x2f/0x7e0
[ 42.356973][ T1] ? ret_from_fork+0x6d/0x90
[ 42.356973][ T1] net_rx_queue_update_kobjects+0x1eb/0xa80
[ 42.356973][ T1] ? kmsan_get_metadata+0x146/0x1c0
[ 42.356973][ T1] netdev_register_kobject+0x30e/0x530
[ 42.356973][ T1] register_netdevice+0x1995/0x2180
[ 42.356973][ T1] register_netdev+0xa5/0xe0
[ 42.356973][ T1] vti6_init_net+0x3f9/0x6a0
[ 42.356973][ T1] ? __pfx_vti6_init_net+0x10/0x10
[ 42.356973][ T1] ops_init+0x30c/0x880
[ 42.356973][ T1] register_pernet_operations+0x523/0xa00
[ 42.356973][ T1] register_pernet_device+0x4f/0x180
[ 42.356973][ T1] ? kmsan_get_metadata+0x146/0x1c0
[ 42.356973][ T1] vti6_tunnel_init+0x34/0x450
[ 42.356973][ T1] ? __pfx_vti6_tunnel_init+0x10/0x10
[ 42.356973][ T1] do_one_initcall+0x219/0x970
[ 42.356973][ T1] ? __pfx_vti6_tunnel_init+0x10/0x10
[ 42.356973][ T1] ? kmsan_get_metadata+0x146/0x1c0
[ 42.356973][ T1] ? kmsan_get_shadow_origin_ptr+0x4d/0xa0
[ 42.356973][ T1] ? filter_irq_stacks+0x164/0x1a0
[ 42.356973][ T1] ? stack_depot_save_flags+0x2c/0x6a0
[ 42.356973][ T1] ? kmsan_get_metadata+0x146/0x1c0
[ 42.356973][ T1] ? kmsan_get_metadata+0x146/0x1c0
[ 42.356973][ T1] ? kmsan_get_shadow_origin_ptr+0x4d/0xa0
[ 42.356973][ T1] ? kmsan_get_metadata+0x146/0x1c0
[ 42.356973][ T1] ? kmsan_get_shadow_origin_ptr+0x4d/0xa0
[ 42.356973][ T1] ? parse_args+0x152c/0x1600
[ 42.356973][ T1] ? kmsan_get_metadata+0x146/0x1c0
[ 42.356973][ T1] ? kmsan_get_shadow_origin_ptr+0x4d/0xa0
[ 42.356973][ T1] ? __pfx_vti6_tunnel_init+0x10/0x10
[ 42.356973][ T1] do_initcall_level+0x140/0x350
[ 42.356973][ T1] do_initcalls+0xf0/0x1e0
[ 42.356973][ T1] ? __pfx_native_smp_prepare_cpus+0x10/0x10
[ 42.356973][ T1] do_basic_setup+0x22/0x30
[ 42.356973][ T1] kernel_init_freeable+0x30b/0x4c0
[ 42.356973][ T1] ? __pfx_kernel_init+0x10/0x10
[ 42.356973][ T1] kernel_init+0x2f/0x7e0
[ 42.356973][ T1] ? __pfx_kernel_init+0x10/0x10
[ 42.356973][ T1] ret_from_fork+0x6d/0x90
[ 42.356973][ T1] ? __pfx_kernel_init+0x10/0x10
[ 42.356973][ T1] ret_from_fork_asm+0x1a/0x30
[ 42.356973][ T1] </TASK>
[ 42.356973][ T1] Kernel Offset: disabled
syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.21.4'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build2225259581=/tmp/go-build -gno-record-gcc-switches'
git status (err=<nil>)
HEAD detached at b438bd66d
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:32: run command via tools/syz-env for best compatibility, see:
Makefile:33: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=b438bd66d6f95113d52f25c25bfef0e963c8ce8d -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240109-174804'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=b438bd66d6f95113d52f25c25bfef0e963c8ce8d -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240109-174804'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=b438bd66d6f95113d52f25c25bfef0e963c8ce8d -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240109-174804'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-stress github.com/google/syzkaller/tools/syz-stress
mkdir -p ./bin/linux_amd64
gcc -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"b438bd66d6f95113d52f25c25bfef0e963c8ce8d\"
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=136675fa180000
Tested on:
commit: 855684c7 Merge tag 'x86_tdx_for_6.9' of git://git.kern..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=6b3a9c97e8057f25
dashboard link: https://syzkaller.appspot.com/bug?extid=2ef3a8ce8e91b5a50098
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=13951646180000
Powered by blists - more mailing lists