syzbot

 sign-in | mailing list | source | docs
🐞 Open [1487]
≡ Subsystems
🐞 Fixed [6798]
🐞 Invalid [17555]
⬇ Missing Backports [222]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
💬 Send us feedback

KMSAN: uninit-value in io_fallback_req_func

Status: auto-obsoleted due to no activity on 2022/09/28 20:35
Subsystems: fs io-uring
[Documentation on labels]
Reported-by: syzbot+5ca552d10251920ab7e2@syzkaller.appspotmail.com
First crash: 1527d, last: 1335d
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] KMSAN: uninit-value in io_fallback_req_func 0 (1) 2022/04/22 09:35
▶ ▼ Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: use-after-free Read in io_fallback_req_func io-uring 19 C error 18 1066d 1070d 0/29 auto-obsoleted due to no activity on 2023/04/26 03:08
upstream general protection fault in io_issue_sqe io-uring fs 12 C done unreliable 502 1210d 1567d 0/29 auto-obsoleted due to no activity on 2023/04/19 14:13
upstream KMSAN: uninit-value in io_req_caches_free fs io-uring 7 C 6 1391d 1467d 0/29 auto-closed as invalid on 2022/09/27 16:29
▶ ▼ Last patch testing requests (2)
Created Duration User Patch Repo Result
2022/09/28 18:30 22m retest repro https://github.com/google/kmsan.git master OK log
2022/07/03 05:58 21m gautammenghani201@gmail.com https://github.com/google/kmsan.git master OK log

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in io_fallback_req_func+0x218/0x5f7 fs/io_uring.c:1399
 io_fallback_req_func+0x218/0x5f7 fs/io_uring.c:1399
 process_one_work+0xdb6/0x1820 kernel/workqueue.c:2307
 worker_thread+0x10b3/0x21e0 kernel/workqueue.c:2454
 kthread+0x3c7/0x500 kernel/kthread.c:377
 ret_from_fork+0x1f/0x30

Uninit was created at:
 slab_post_alloc_hook mm/slab.h:737 [inline]
 kmem_cache_alloc_bulk+0xe98/0x1530 mm/slub.c:3744
 __io_alloc_req_refill+0x482/0x867 fs/io_uring.c:2072
 io_alloc_req_refill fs/io_uring.c:2098 [inline]
 io_submit_sqes+0x7d4/0x1a00 fs/io_uring.c:7441
 __do_sys_io_uring_enter fs/io_uring.c:10162 [inline]
 __se_sys_io_uring_enter+0x62f/0x23a0 fs/io_uring.c:10104
 __x64_sys_io_uring_enter+0x19d/0x200 fs/io_uring.c:10104
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x44/0xae

CPU: 0 PID: 3552 Comm: kworker/0:4 Not tainted 5.17.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Comput

Crashes (8):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/04/22 08:53 https://github.com/google/kmsan.git master 33d9269ef6e0 2738b391 .config console log report syz C ci-upstream-kmsan-gce KMSAN: uninit-value in io_fallback_req_func
2022/04/22 07:31 https://github.com/google/kmsan.git master 33d9269ef6e0 2738b391 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in io_fallback_req_func
2022/03/27 10:12 https://github.com/google/kmsan.git master 97c7732c2bb6 89bc8608 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in io_fallback_req_func
2022/01/02 05:34 https://github.com/google/kmsan.git master 81c325bbf94e e1768e9c .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in io_fallback_req_func
2021/11/16 12:44 https://github.com/google/kmsan.git master 386004877847 600426bd .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in io_fallback_req_func
2021/10/29 18:14 https://github.com/google/kmsan.git master 45859661869b 2353a3ec .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in io_fallback_req_func
2021/10/28 21:12 https://github.com/google/kmsan.git master 1e128e535256 be531bb4 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in io_fallback_req_func
2021/10/12 11:58 https://github.com/google/kmsan.git master c7f84f4e1147 838e7e2c .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in io_fallback_req_func
* Struck through repros no longer work on HEAD.