KMSAN: uninit-value in vga16fb_imageblit

Status: auto-closed as invalid on 2021/03/09 16:56
Subsystems: fbdev
[Documentation on labels]
Reported-by: syzbot+370e5ded96ace049ac26@syzkaller.appspotmail.com
First crash: 2223d, last: 2141d
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
KMSAN: uninit-value in vga16fb_imageblit 0 (1) 2020/08/23 06:58

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in writeb arch/x86/include/asm/io.h:65 [inline]
BUG: KMSAN: uninit-value in vga_imageblit_expand drivers/video/fbdev/vga16fb.c:1176 [inline]
BUG: KMSAN: uninit-value in vga16fb_imageblit+0xe4b/0x1b20 drivers/video/fbdev/vga16fb.c:1260
CPU: 0 PID: 10876 Comm: syz-executor.4 Not tainted 5.9.0-rc8-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x21c/0x280 lib/dump_stack.c:118
 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:122
 __msan_warning+0x5f/0xa0 mm/kmsan/kmsan_instr.c:201
 writeb arch/x86/include/asm/io.h:65 [inline]
 vga_imageblit_expand drivers/video/fbdev/vga16fb.c:1176 [inline]
 vga16fb_imageblit+0xe4b/0x1b20 drivers/video/fbdev/vga16fb.c:1260
 bit_putcs+0x3129/0x33b0 drivers/video/fbdev/core/bitblit.c:139
 fbcon_putcs+0x122e/0x1260 drivers/video/fbdev/core/fbcon.c:1308
 do_update_region+0x5d7/0xc00 drivers/tty/vt/vt.c:665
 redraw_screen+0x111d/0x1380 drivers/tty/vt/vt.c:1034
 fbcon_blank+0xb75/0x14e0 drivers/video/fbdev/core/fbcon.c:2252
 do_unblank_screen+0x4f9/0x890 drivers/tty/vt/vt.c:4402
 unblank_screen drivers/tty/vt/vt.c:4421 [inline]
 poke_blanked_console+0x2cd/0x3d0 drivers/tty/vt/vt.c:4456
 vc_selection drivers/tty/vt/selection.c:321 [inline]
 set_selection_kernel+0xae/0x3930 drivers/tty/vt/selection.c:359
 set_selection_user+0x12a/0x170 drivers/tty/vt/selection.c:185
 tioclinux+0x24d/0xd00 drivers/tty/vt/vt.c:3155
 vt_ioctl+0x1a55/0x67e0 drivers/tty/vt/vt_ioctl.c:862
 vt_compat_ioctl+0x5cb/0x1030 drivers/tty/vt/vt_ioctl.c:1257
 tty_compat_ioctl+0x74b/0x1660 drivers/tty/tty_io.c:2847
 __do_compat_sys_ioctl fs/ioctl.c:842 [inline]
 __se_compat_sys_ioctl+0x53d/0x1100 fs/ioctl.c:793
 __ia32_compat_sys_ioctl+0x4a/0x70 fs/ioctl.c:793
 do_syscall_32_irqs_on arch/x86/entry/common.c:80 [inline]
 __do_fast_syscall_32+0x129/0x180 arch/x86/entry/common.c:139
 do_fast_syscall_32+0x6a/0xc0 arch/x86/entry/common.c:162
 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:205
 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c
RIP: 0023:0xf7f49549
Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 002b:00000000f55430cc EFLAGS: 00000296 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000000541c
RDX: 0000000020000040 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000

Uninit was stored to memory at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:129 [inline]
 kmsan_internal_chain_origin+0xad/0x130 mm/kmsan/kmsan.c:297
 __msan_chain_origin+0x57/0xa0 mm/kmsan/kmsan_instr.c:151
 __fb_pad_aligned_buffer include/linux/fb.h:654 [inline]
 bit_putcs_aligned drivers/video/fbdev/core/bitblit.c:96 [inline]
 bit_putcs+0x2dcb/0x33b0 drivers/video/fbdev/core/bitblit.c:185
 fbcon_putcs+0x122e/0x1260 drivers/video/fbdev/core/fbcon.c:1308
 do_update_region+0x5d7/0xc00 drivers/tty/vt/vt.c:665
 redraw_screen+0x111d/0x1380 drivers/tty/vt/vt.c:1034
 fbcon_blank+0xb75/0x14e0 drivers/video/fbdev/core/fbcon.c:2252
 do_unblank_screen+0x4f9/0x890 drivers/tty/vt/vt.c:4402
 unblank_screen drivers/tty/vt/vt.c:4421 [inline]
 poke_blanked_console+0x2cd/0x3d0 drivers/tty/vt/vt.c:4456
 vc_selection drivers/tty/vt/selection.c:321 [inline]
 set_selection_kernel+0xae/0x3930 drivers/tty/vt/selection.c:359
 set_selection_user+0x12a/0x170 drivers/tty/vt/selection.c:185
 tioclinux+0x24d/0xd00 drivers/tty/vt/vt.c:3155
 vt_ioctl+0x1a55/0x67e0 drivers/tty/vt/vt_ioctl.c:862
 vt_compat_ioctl+0x5cb/0x1030 drivers/tty/vt/vt_ioctl.c:1257
 tty_compat_ioctl+0x74b/0x1660 drivers/tty/tty_io.c:2847
 __do_compat_sys_ioctl fs/ioctl.c:842 [inline]
 __se_compat_sys_ioctl+0x53d/0x1100 fs/ioctl.c:793
 __ia32_compat_sys_ioctl+0x4a/0x70 fs/ioctl.c:793
 do_syscall_32_irqs_on arch/x86/entry/common.c:80 [inline]
 __do_fast_syscall_32+0x129/0x180 arch/x86/entry/common.c:139
 do_fast_syscall_32+0x6a/0xc0 arch/x86/entry/common.c:162
 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:205
 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:129 [inline]
 kmsan_internal_poison_shadow+0x5c/0xf0 mm/kmsan/kmsan.c:112
 kmsan_slab_alloc+0x8d/0xe0 mm/kmsan/kmsan_hooks.c:80
 slab_alloc_node mm/slub.c:2903 [inline]
 slab_alloc mm/slub.c:2912 [inline]
 __kmalloc+0x282/0x490 mm/slub.c:3978
 kmalloc include/linux/slab.h:559 [inline]
 fbcon_set_font+0x5ac/0xf40 drivers/video/fbdev/core/fbcon.c:2496
 con_font_set drivers/tty/vt/vt.c:4663 [inline]
 con_font_op+0x204e/0x21b0 drivers/tty/vt/vt.c:4728
 vt_io_ioctl drivers/tty/vt/vt_ioctl.c:586 [inline]
 vt_ioctl+0x14b2/0x67e0 drivers/tty/vt/vt_ioctl.c:856
 vt_compat_ioctl+0x5cb/0x1030 drivers/tty/vt/vt_ioctl.c:1257
 tty_compat_ioctl+0x74b/0x1660 drivers/tty/tty_io.c:2847
 __do_compat_sys_ioctl fs/ioctl.c:842 [inline]
 __se_compat_sys_ioctl+0x53d/0x1100 fs/ioctl.c:793
 __ia32_compat_sys_ioctl+0x4a/0x70 fs/ioctl.c:793
 do_syscall_32_irqs_on arch/x86/entry/common.c:80 [inline]
 __do_fast_syscall_32+0x129/0x180 arch/x86/entry/common.c:139
 do_fast_syscall_32+0x6a/0xc0 arch/x86/entry/common.c:162
 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:205
 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c
=====================================================

Crashes (14):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/11/09 16:55 https://github.com/google/kmsan.git master e16174226146 64069d48 .config console log report info ci-upstream-kmsan-gce-386
2020/11/05 10:34 https://github.com/google/kmsan.git master e16174226146 64069d48 .config console log report info ci-upstream-kmsan-gce-386
2020/10/31 05:49 https://github.com/google/kmsan.git master e16174226146 18e33098 .config console log report info ci-upstream-kmsan-gce-386
2020/10/07 16:01 https://github.com/google/kmsan.git master 5edb1df295b9 1880b4a9 .config console log report info ci-upstream-kmsan-gce-386
2020/09/27 13:32 https://github.com/google/kmsan.git master c5a13b33ec11 5dd8aee8 .config console log report info ci-upstream-kmsan-gce-386
2020/09/11 11:13 https://github.com/google/kmsan.git master 3b3ea6028136 adfb8b4e .config console log report ci-upstream-kmsan-gce-386
2020/09/10 05:41 https://github.com/google/kmsan.git master 3b3ea6028136 409809d8 .config console log report ci-upstream-kmsan-gce-386
2020/09/03 15:29 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce-386
2020/09/01 23:06 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce-386
2020/08/31 08:07 https://github.com/google/kmsan.git master 3b3ea6028136 d5a3ae1f .config console log report ci-upstream-kmsan-gce-386
2020/08/25 01:59 https://github.com/google/kmsan.git master ce8056d1f79e 344da168 .config console log report ci-upstream-kmsan-gce-386
2020/08/23 21:06 https://github.com/google/kmsan.git master ce8056d1f79e cef5ae68 .config console log report ci-upstream-kmsan-gce-386
2020/08/21 00:08 https://github.com/google/kmsan.git master ce8056d1f79e 1d75fe45 .config console log report ci-upstream-kmsan-gce-386
2020/08/19 03:38 https://github.com/google/kmsan.git master ce8056d1f79e e1c29030 .config console log report ci-upstream-kmsan-gce-386
* Struck through repros no longer work on HEAD.