| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <68e3d487.a70a0220.160221.0002.GAE@google.com>
Date: Mon, 06 Oct 2025 07:39:03 -0700
From: syzbot <syzbot+83c9dd5c0dcf6184fdbf@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org, nirbhay.lkd@...il.com,
syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [ntfs3?] KMSAN: uninit-value in attr_set_size
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
dule.
[ 8.288207][ T1] RPC: Registered udp transport module.
[ 8.289931][ T1] RPC: Registered tcp transport module.
[ 8.291845][ T1] RPC: Registered tcp-with-tls transport module.
[ 8.293772][ T1] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 8.331348][ T1] NET: Registered PF_XDP protocol family
[ 8.333135][ T1] pci_bus 0000:00: resource 4 [io 0x0000-0x0cf7 window]
[ 8.336032][ T1] pci_bus 0000:00: resource 5 [io 0x0d00-0xffff window]
[ 8.338411][ T1] pci_bus 0000:00: resource 6 [mem 0x000a0000-0x000bffff window]
[ 8.340200][ T1] pci_bus 0000:00: resource 7 [mem 0xc0000000-0xfebfefff window]
[ 8.347159][ T1] pci 0000:00:00.0: Limiting direct PCI/PCI transfers
[ 8.350898][ T1] PCI: CLS 0 bytes, default 64
[ 8.352908][ T1] PCI-DMA: Using software bounce buffering for IO (SWIOTLB)
[ 8.355024][ T1] software IO TLB: mapped [mem 0x00000000bbffd000-0x00000000bfffd000] (64MB)
[ 8.358033][ T1] ACPI: bus type thunderbolt registered
[ 8.387288][ T61] kworker/u8:1 (61) used greatest stack depth: 11960 bytes left
[ 8.495149][ T1] RAPL PMU: API unit is 2^-32 Joules, 0 fixed counters, 10737418240 ms ovfl timer
[ 8.648953][ T1] kvm_amd: CPU 1 isn't AMD or Hygon
[ 8.650444][ T1] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x1fb6c80a799, max_idle_ns: 440795272342 ns
[ 9.016382][ T1] clocksource: Switched to clocksource tsc
[ 9.019550][ T62] kworker/u8:3 (62) used greatest stack depth: 11816 bytes left
[ 34.691907][ T1] Initialise system trusted keyrings
[ 34.701905][ T1] workingset: timestamp_bits=40 max_order=21 bucket_order=0
[ 34.713356][ T1] DLM installed
[ 34.727734][ T1] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 34.757434][ T1] NFS: Registering the id_resolver key type
[ 34.763850][ T1] Key type id_resolver registered
[ 34.768945][ T1] Key type id_legacy registered
[ 34.774737][ T1] nfs4filelayout_init: NFSv4 File Layout Driver Registering...
[ 34.782570][ T1] nfs4flexfilelayout_init: NFSv4 Flexfile Layout Driver Registering...
[ 34.816751][ T1] Key type cifs.spnego registered
[ 34.822596][ T1] Key type cifs.idmap registered
[ 34.835867][ T1] ntfs3: Enabled Linux POSIX ACLs support
[ 34.841823][ T1] ntfs3: Read-only LZX/Xpress compression included
[ 34.848915][ T1] efs: 1.0a - http://aeschi.ch.eu.org/efs/
[ 34.855288][ T1] romfs: ROMFS MTD (C) 2007 Red Hat, Inc.
[ 34.861326][ T1] QNX4 filesystem 0.2.3 registered.
[ 34.867988][ T1] qnx6: QNX6 filesystem 1.0.0 registered.
[ 34.875504][ T1] fuse: init (API version 7.45)
[ 34.886866][ T1] orangefs_debugfs_init: called with debug mask: :none: :0:
[ 34.895794][ T1] orangefs_init: module version upstream loaded
[ 34.904152][ T1] JFS: nTxBlock = 8192, nTxLock = 65536
[ 34.948833][ T1] SGI XFS with ACLs, security attributes, realtime, quota, no debug enabled
[ 34.965946][ T1] 9p: Installing v9fs 9p2000 file system support
[ 34.973347][ T1] NILFS version 2 loaded
[ 34.977862][ T1] befs: version: 0.9.3
[ 34.983005][ T1] ocfs2: Registered cluster interface o2cb
[ 34.991273][ T1] ocfs2: Registered cluster interface user
[ 34.998495][ T1] OCFS2 User DLM kernel interface loaded
[ 35.017803][ T1] gfs2: GFS2 installed
[ 35.059251][ T1] ceph: loaded (mds proto 32)
[ 35.806968][ T1] NET: Registered PF_ALG protocol family
[ 35.813312][ T1] xor: automatically using best checksumming function avx
[ 35.821495][ T1] async_tx: api initialized (async)
[ 35.826889][ T1] Key type asymmetric registered
[ 35.831892][ T1] Asymmetric key parser 'x509' registered
[ 35.837768][ T1] Asymmetric key parser 'pkcs8' registered
[ 35.843909][ T1] Key type pkcs7_test registered
[ 35.850310][ T1] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 239)
[ 35.860582][ T1] io scheduler mq-deadline registered
[ 35.866502][ T1] io scheduler kyber registered
[ 35.871959][ T1] io scheduler bfq registered
[ 35.891367][ T1] input: Power Button as /devices/LNXSYSTM:00/LNXPWRBN:00/input/input0
[ 35.902076][ T140] kworker/u8:2 (140) used greatest stack depth: 10968 bytes left
[ 35.911355][ T1] ACPI: button: Power Button [PWRF]
[ 35.919612][ T1] input: Sleep Button as /devices/LNXSYSTM:00/LNXSLPBN:00/input/input1
[ 35.930796][ T1] ACPI: button: Sleep Button [SLPF]
[ 35.957609][ T1] ioatdma: Intel(R) QuickData Technology Driver 5.00
[ 36.038568][ T1] ACPI: \_SB_.LNKC: Enabled at IRQ 11
[ 36.044867][ T1] virtio-pci 0000:00:03.0: virtio_pci: leaving for legacy driver
[ 36.123929][ T1] ACPI: \_SB_.LNKD: Enabled at IRQ 10
[ 36.129736][ T1] virtio-pci 0000:00:04.0: virtio_pci: leaving for legacy driver
[ 36.208303][ T1] ACPI: \_SB_.LNKB: Enabled at IRQ 10
[ 36.214188][ T1] virtio-pci 0000:00:06.0: virtio_pci: leaving for legacy driver
[ 36.273080][ T1] virtio-pci 0000:00:07.0: virtio_pci: leaving for legacy driver
[ 37.416353][ T1] N_HDLC line discipline registered with maxframe=4096
[ 37.425415][ T1] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
[ 37.437763][ T1] 00:03: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A
[ 37.472838][ T1] 00:04: ttyS1 at I/O 0x2f8 (irq = 3, base_baud = 115200) is a 16550A
[ 37.510114][ T1] 00:05: ttyS2 at I/O 0x3e8 (irq = 6, base_baud = 115200) is a 16550A
[ 37.542088][ T1] 00:06: ttyS3 at I/O 0x2e8 (irq = 7, base_baud = 115200) is a 16550A
[ 37.596348][ T1] Non-volatile memory driver v1.3
[ 37.622619][ T1] Linux agpgart interface v0.103
[ 37.636015][ T1] usbcore: registered new interface driver xillyusb
[ 37.652287][ T1] ACPI: bus type drm_connector registered
[ 37.677443][ T1] [drm] Initialized vgem 1.0.0 for vgem on minor 0
[ 37.700372][ T1] [drm] Initialized vkms 1.0.0 for vkms on minor 1
[ 38.011203][ T1] Console: switching to colour frame buffer device 128x48
[ 38.099833][ T1] faux_driver vkms: [drm] fb0: vkmsdrmfb frame buffer device
[ 38.108152][ T1] usbcore: registered new interface driver udl
[ 38.119676][ T1] usbcore: registered new interface driver gm12u320
[ 38.127305][ T1] usbcore: registered new interface driver gud
[ 38.279542][ T1] brd: module loaded
[ 38.672678][ T1] loop: module loaded
[ 38.970689][ T1] zram: Added device: zram0
[ 38.996271][ T1] null_blk: disk nullb0 created
[ 39.001274][ T1] null_blk: module loaded
[ 39.008475][ T1] Guest personality initialized and is inactive
[ 39.016196][ T1] VMCI host device registered (name=vmci, major=10, minor=265)
[ 39.024148][ T1] Initialized host personality
[ 39.029706][ T1] usbcore: registered new interface driver rtsx_usb
[ 39.042104][ T1] usbcore: registered new interface driver viperboard
[ 39.050349][ T1] usbcore: registered new interface driver dln2
[ 39.058525][ T1] usbcore: registered new interface driver pn533_usb
[ 39.072218][ T1] nfcsim 0.2 initialized
[ 39.077348][ T1] usbcore: registered new interface driver port100
[ 39.084860][ T1] usbcore: registered new interface driver nfcmrvl
[ 39.102738][ T1] Loading iSCSI transport class v2.0-870.
[ 39.144075][ T1] virtio_scsi virtio0: 1/0/0 default/read/poll queues
[ 39.180630][ T1] scsi host0: Virtio SCSI HBA
[ 39.707208][ T1] st: Version 20160209, fixed bufsize 32768, s/g segs 256
[ 39.726184][ T35] scsi 0:0:1:0: Direct-Access Google PersistentDisk 1 PQ: 0 ANSI: 6
[ 39.759242][ T35] =====================================================
[ 39.767633][ T35] BUG: KMSAN: use-after-free in scsi_get_vpd_buf+0x4cc/0x720
[ 39.776263][ T35] scsi_get_vpd_buf+0x4cc/0x720
[ 39.781276][ T35] scsi_attach_vpd+0x974/0xe70
[ 39.787803][ T35] scsi_probe_and_add_lun+0x6933/0x7f20
[ 39.788235][ T1] Rounding down aligned max_sectors from 4294967295 to 4294967288
[ 39.795150][ T35] __scsi_scan_target+0x2fb/0x2050
[ 39.804255][ T1] db_root: cannot open: /etc/target
[ 39.806728][ T35] scsi_scan_host_selected+0x68f/0x9a0
[ 39.817463][ T35] do_scan_async+0x1ad/0xdc0
[ 39.822216][ T35] async_run_entry_fn+0x90/0x570
[ 39.827441][ T35] process_scheduled_works+0xb91/0x1d80
[ 39.833182][ T35] worker_thread+0xedf/0x1590
[ 39.838088][ T35] kthread+0xd59/0xf00
[ 39.842300][ T35] ret_from_fork+0x230/0x380
[ 39.847156][ T35] ret_from_fork_asm+0x1a/0x30
[ 39.852097][ T35]
[ 39.854573][ T35] Uninit was created at:
[ 39.859003][ T35] kfree+0x254/0x1460
[ 39.863131][ T35] call_usermodehelper_exec_async+0x666/0x6f0
[ 39.869451][ T35] ret_from_fork+0x230/0x380
[ 39.874294][ T35] ret_from_fork_asm+0x1a/0x30
[ 39.879336][ T35]
[ 39.881773][ T35] CPU: 1 UID: 0 PID: 35 Comm: kworker/u8:2 Not tainted syzkaller #0 PREEMPT(none)
[ 39.891297][ T35] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
[ 39.891399][ T1] eql: Equalizer2002: Simon Janes (simon@....com) and David S. Miller (davem@...hat.com)
[ 39.901579][ T35] Workqueue: async async_run_entry_fn
[ 39.917166][ T35] =====================================================
[ 39.924258][ T35] Disabling lock debugging due to kernel taint
[ 39.930495][ T35] Kernel panic - not syncing: kmsan.panic set ...
[ 39.934188][ T35] CPU: 1 UID: 0 PID: 35 Comm: kworker/u8:2 Tainted: G B syzkaller #0 PREEMPT(none)
[ 39.934188][ T35] Tainted: [B]=BAD_PAGE
[ 39.934188][ T35] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
[ 39.954023][ T35] Workqueue: async async_run_entry_fn
[ 39.954023][ T35] Call Trace:
[ 39.954023][ T35] <TASK>
[ 39.954023][ T35] __dump_stack+0x26/0x30
[ 39.954023][ T35] dump_stack_lvl+0x53/0x270
[ 39.983756][ T35] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0
[ 39.984028][ T35] dump_stack+0x1e/0x25
[ 39.984028][ T35] vpanic+0x435/0xd30
[ 39.984028][ T35] panic+0x15d/0x160
[ 39.984028][ T35] kmsan_report+0x31c/0x320
[ 39.984028][ T35] ? __msan_warning+0x1b/0x30
[ 39.984028][ T35] ? scsi_get_vpd_buf+0x4cc/0x720
[ 39.984028][ T35] ? scsi_attach_vpd+0x974/0xe70
[ 39.984028][ T35] ? scsi_probe_and_add_lun+0x6933/0x7f20
[ 40.024987][ T35] ? __scsi_scan_target+0x2fb/0x2050
[ 40.031990][ T35] ? scsi_scan_host_selected+0x68f/0x9a0
[ 40.031990][ T35] ? do_scan_async+0x1ad/0xdc0
[ 40.031990][ T35] ? async_run_entry_fn+0x90/0x570
[ 40.031990][ T35] ? process_scheduled_works+0xb91/0x1d80
[ 40.031990][ T35] ? worker_thread+0xedf/0x1590
[ 40.031990][ T35] ? kthread+0xd59/0xf00
[ 40.031990][ T35] ? ret_from_fork+0x230/0x380
[ 40.031990][ T35] ? ret_from_fork_asm+0x1a/0x30
[ 40.074129][ T35] ? blk_mq_free_request+0x3b6/0x600
[ 40.074129][ T35] ? scsi_execute_cmd+0x1add/0x1c70
[ 40.074129][ T35] ? kmsan_get_metadata+0xfb/0x160
[ 40.103719][ T35] __msan_warning+0x1b/0x30
[ 40.103719][ T35] scsi_get_vpd_buf+0x4cc/0x720
[ 40.103719][ T35] scsi_attach_vpd+0x974/0xe70
[ 40.103719][ T35] scsi_probe_and_add_lun+0x6933/0x7f20
[ 40.133877][ T35] __scsi_scan_target+0x2fb/0x2050
[ 40.133877][ T35] ? kmsan_internal_set_shadow_origin+0x7a/0x110
[ 40.133877][ T35] ? _raw_spin_unlock_irqrestore+0x3f/0x60
[ 40.133877][ T35] ? __pm_runtime_resume+0x1f7/0x230
[ 40.133877][ T35] ? kmsan_get_metadata+0xfb/0x160
[ 40.163605][ T35] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0
[ 40.163605][ T35] scsi_scan_host_selected+0x68f/0x9a0
[ 40.163605][ T35] do_scan_async+0x1ad/0xdc0
[ 40.163605][ T35] ? ktime_get+0x530/0x590
[ 40.163605][ T35] ? kmsan_get_metadata+0xfb/0x160
[ 40.163605][ T35] async_run_entry_fn+0x90/0x570
[ 40.193576][ T35] ? kmsan_get_metadata+0xfb/0x160
[ 40.193576][ T35] ? __pfx_do_scan_async+0x10/0x10
[ 40.193576][ T35] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0
[ 40.193576][ T35] ? __pfx_async_run_entry_fn+0x10/0x10
[ 40.193576][ T35] process_scheduled_works+0xb91/0x1d80
[ 40.223593][ T35] worker_thread+0xedf/0x1590
[ 40.223593][ T35] kthread+0xd59/0xf00
[ 40.223593][ T35] ? __pfx_worker_thread+0x10/0x10
[ 40.223593][ T35] ? __pfx_kthread+0x10/0x10
[ 40.223593][ T35] ret_from_fork+0x230/0x380
[ 40.223593][ T35] ? __pfx_kthread+0x10/0x10
[ 40.223593][ T35] ret_from_fork_asm+0x1a/0x30
[ 40.223593][ T35] </TASK>
[ 40.223593][ T35] Kernel Offset: disabled
[ 40.223593][ T35] Rebooting in 86400 seconds..
syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build4190601459=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.24.4'
GOWORK=''
PKG_CONFIG='pkg-config'
git status (err=<nil>)
HEAD detached at 49379ee008e
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=49379ee008e5f2af6e551c2e23fcd6b1ebb4d5c2 -X github.com/google/syzkaller/prog.gitRevisionDate=20251002-084935" ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=49379ee008e5f2af6e551c2e23fcd6b1ebb4d5c2 -X github.com/google/syzkaller/prog.gitRevisionDate=20251002-084935" ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=49379ee008e5f2af6e551c2e23fcd6b1ebb4d5c2 -X github.com/google/syzkaller/prog.gitRevisionDate=20251002-084935" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"49379ee008e5f2af6e551c2e23fcd6b1ebb4d5c2\"
/usr/bin/ld: /tmp/ccqyzhm0.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=12999a7c580000
Tested on:
commit: fd94619c Merge tag 'zonefs-6.18-rc1' of git://git.kern..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=ad506767107aacda
dashboard link: https://syzkaller.appspot.com/bug?extid=83c9dd5c0dcf6184fdbf
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=122bd092580000
Powered by blists - more mailing lists