linux-kernel - Re: [syzbot] [io-uring?] KMSAN: uninit-value in io_req_task_work_add

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <64844b2a-d4aa-4b1f-8954-049850e38c1e@kernel.dk>
Date: Wed, 24 Jul 2024 14:34:49 -0600
From: Jens Axboe <axboe@...nel.dk>
To: syzbot <syzbot+82609b8937a4458106ca@...kaller.appspotmail.com>,
 asml.silence@...il.com, io-uring@...r.kernel.org,
 linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [io-uring?] KMSAN: uninit-value in
 io_req_task_work_add_remote

On 7/24/24 12:59 PM, syzbot wrote:
> Hello,
> 
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> KMSAN: uninit-value in io_req_task_work_add_remote
> 
> =====================================================
> BUG: KMSAN: uninit-value in io_req_local_work_add io_uring/io_uring.c:1193 [inline]
> BUG: KMSAN: uninit-value in io_req_task_work_add_remote+0x592/0x5e0 io_uring/io_uring.c:1241
>  io_req_local_work_add io_uring/io_uring.c:1193 [inline]
>  io_req_task_work_add_remote+0x592/0x5e0 io_uring/io_uring.c:1241
>  io_msg_remote_post io_uring/msg_ring.c:102 [inline]
>  io_msg_data_remote io_uring/msg_ring.c:133 [inline]
>  io_msg_ring_data io_uring/msg_ring.c:152 [inline]
>  io_msg_ring+0x1c38/0x1ef0 io_uring/msg_ring.c:305
>  io_issue_sqe+0x383/0x22c0 io_uring/io_uring.c:1711
>  io_queue_sqe io_uring/io_uring.c:1925 [inline]
>  io_submit_sqe io_uring/io_uring.c:2181 [inline]
>  io_submit_sqes+0x1259/0x2f20 io_uring/io_uring.c:2296
>  __do_sys_io_uring_enter io_uring/io_uring.c:3206 [inline]
>  __se_sys_io_uring_enter+0x40c/0x3ca0 io_uring/io_uring.c:3143
>  __x64_sys_io_uring_enter+0x11f/0x1a0 io_uring/io_uring.c:3143
>  x64_sys_call+0x2d82/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:427
>  do_syscall_x64 arch/x86/entry/common.c:52 [inline]
>  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> 
> Uninit was created at:
>  __alloc_pages_noprof+0x9d6/0xe70 mm/page_alloc.c:4719
>  __alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
>  alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
>  alloc_slab_page mm/slub.c:2321 [inline]
>  allocate_slab+0x203/0x1220 mm/slub.c:2484
>  new_slab mm/slub.c:2537 [inline]
>  ___slab_alloc+0x12ef/0x35e0 mm/slub.c:3723
>  __kmem_cache_alloc_bulk mm/slub.c:4759 [inline]
>  kmem_cache_alloc_bulk_noprof+0x486/0x1330 mm/slub.c:4831
>  __io_alloc_req_refill+0x84/0x560 io_uring/io_uring.c:940
>  io_alloc_req io_uring/io_uring.h:393 [inline]
>  io_submit_sqes+0x171b/0x2f20 io_uring/io_uring.c:2285
>  __do_sys_io_uring_enter io_uring/io_uring.c:3206 [inline]
>  __se_sys_io_uring_enter+0x40c/0x3ca0 io_uring/io_uring.c:3143
>  __x64_sys_io_uring_enter+0x11f/0x1a0 io_uring/io_uring.c:3143
>  x64_sys_call+0x2d82/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:427
>  do_syscall_x64 arch/x86/entry/common.c:52 [inline]
>  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> 
> CPU: 0 UID: 0 PID: 5924 Comm: syz.0.16 Not tainted 6.10.0-syzkaller-12268-g7a3fad30fd8b-dirty #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
> =====================================================

#syz test

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 8e6faa942a6f..198bbbfe465c 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -1164,8 +1164,10 @@ static inline void io_req_local_work_add(struct io_kiocb *req,
 		 * previous adds should've tried to wake the task.
 		 */
 		nr_tw = nr_tw_prev + 1;
+#if 0
 		if (!(flags & IOU_F_TWQ_LAZY_WAKE))
 			nr_tw = IO_CQ_WAKE_FORCE;
+#endif
 
 		req->nr_tw = nr_tw;
 		req->io_task_work.node.next = head;
-- 
Jens Axboe