netdev - Re: [syzbot] [sctp?] [reiserfs?] KMSAN: uninit-value in _

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAG_fn=Umt5Gm1aFa2Tr8LCXboDZvBx9WBw_AvvkN3_7eyXSsRg@mail.gmail.com>
Date: Thu, 14 Sep 2023 18:06:01 +0200
From: Alexander Potapenko <glider@...gle.com>
To: Marcelo Ricardo Leitner <marcelo.leitner@...il.com>
Cc: syzbot <syzbot+00f1a932d27258b183e7@...kaller.appspotmail.com>, bp@...en8.de, 
	brauner@...nel.org, dave.hansen@...ux.intel.com, hpa@...or.com, 
	linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org, 
	linux-sctp@...r.kernel.org, lucien.xin@...il.com, mingo@...hat.com, 
	netdev@...r.kernel.org, reiserfs-devel@...r.kernel.org, 
	syzkaller-bugs@...glegroups.com, tglx@...utronix.de, x86@...nel.org
Subject: Re: [syzbot] [sctp?] [reiserfs?] KMSAN: uninit-value in __schedule (4)

On Thu, Sep 14, 2023 at 5:25 PM Marcelo Ricardo Leitner
<marcelo.leitner@...il.com> wrote:
>
> On Tue, Sep 05, 2023 at 10:55:01AM -0700, syzbot wrote:
> > Hello,
> >
> > syzbot found the following issue on:
> >
> > HEAD commit:    a47fc304d2b6 Add linux-next specific files for 20230831
> > git tree:       linux-next
> > console output: https://syzkaller.appspot.com/x/log.txt?x=131da298680000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=6ecd2a74f20953b9
> > dashboard link: https://syzkaller.appspot.com/bug?extid=00f1a932d27258b183e7
> > compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=116e5fcba80000
> > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=118e912fa80000
>
> Not sure why sctp got tagged here. I could not find anything network
> related on this reproducer or console output.

I am afraid this is the effect of reports from different tools being
clustered together: https://github.com/google/syzkaller/issues/4168
The relevant KMSAN report can be viewed on the dashboard:
https://syzkaller.appspot.com/text?tag=CrashReport&x=144ba287a80000 -
that's where sctp was deduced from.

I suspect there's still nothing specific to sctp though: looks like
schedule_debug() somehow accidentally reads past the end of the task
stack.

>   Marcelo
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@...glegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/cbakbuszcnwtfkdavtif3lwfncelm2ugn6eyd5pd5dmdocxqh5%403op6br7uaxd7.



-- 
Alexander Potapenko
Software Engineer

Google Germany GmbH
Erika-Mann-Straße, 33
80636 München

Geschäftsführer: Paul Manicle, Liana Sebastian
Registergericht und -nummer: Hamburg, HRB 86891
Sitz der Gesellschaft: Hamburg