[syzbot] [crypto?] KMSAN: uninit-value in aes_encrypt (5)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 5d12ed4bea43 Merge tag 'i2c-for-6.9-rc6' of git://git.kern..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16491b80980000
kernel config: https://syzkaller.appspot.com/x/.config?x=1c4a1df36b3414a8
dashboard link: https://syzkaller.appspot.com/bug?extid=aeb14e2539ffb6d21130
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/bb5148c91210/disk-5d12ed4b.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/49a9a8f075f4/vmlinux-5d12ed4b.xz
kernel image: https://storage.googleapis.com/syzbot-assets/1309b451ab44/bzImage-5d12ed4b.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+aeb14e...@syzkaller.appspotmail.com

=====================================================
BUG: KMSAN: uninit-value in subshift lib/crypto/aes.c:149 [inline]
BUG: KMSAN: uninit-value in aes_encrypt+0x15cc/0x1db0 lib/crypto/aes.c:282
subshift lib/crypto/aes.c:149 [inline]
aes_encrypt+0x15cc/0x1db0 lib/crypto/aes.c:282
aesti_encrypt+0x7d/0xf0 crypto/aes_ti.c:31
crypto_ecb_crypt crypto/ecb.c:23 [inline]
crypto_ecb_encrypt2+0x18a/0x300 crypto/ecb.c:40
crypto_lskcipher_crypt_sg+0x36b/0x7f0 crypto/lskcipher.c:228
crypto_lskcipher_encrypt_sg+0x8a/0xc0 crypto/lskcipher.c:247
crypto_skcipher_encrypt+0x119/0x1e0 crypto/skcipher.c:669
xts_encrypt+0x3c4/0x550 crypto/xts.c:269
crypto_skcipher_encrypt+0x1a0/0x1e0 crypto/skcipher.c:671
fscrypt_crypt_data_unit+0x4ee/0x8f0 fs/crypto/crypto.c:144
fscrypt_encrypt_pagecache_blocks+0x422/0x900 fs/crypto/crypto.c:207
ext4_bio_write_folio+0x13db/0x2e40 fs/ext4/page-io.c:526
mpage_submit_folio+0x351/0x4a0 fs/ext4/inode.c:1869
mpage_process_page_bufs+0xb92/0xe30 fs/ext4/inode.c:1982
mpage_process_folio fs/ext4/inode.c:2036 [inline]
mpage_map_and_submit_buffers fs/ext4/inode.c:2105 [inline]
mpage_map_and_submit_extent fs/ext4/inode.c:2254 [inline]
ext4_do_writepages+0x353e/0x62e0 fs/ext4/inode.c:2679
ext4_writepages+0x312/0x830 fs/ext4/inode.c:2768
do_writepages+0x427/0xc30 mm/page-writeback.c:2612
__writeback_single_inode+0x10d/0x12c0 fs/fs-writeback.c:1650
writeback_sb_inodes+0xb48/0x1be0 fs/fs-writeback.c:1941
wb_writeback+0x4a1/0xdf0 fs/fs-writeback.c:2117
wb_do_writeback fs/fs-writeback.c:2264 [inline]
wb_workfn+0x40b/0x1940 fs/fs-writeback.c:2304
process_one_work kernel/workqueue.c:3254 [inline]
process_scheduled_works+0xa81/0x1bd0 kernel/workqueue.c:3335
worker_thread+0xea5/0x1560 kernel/workqueue.c:3416
kthread+0x3e2/0x540 kernel/kthread.c:388
ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Uninit was stored to memory at:
le128_xor include/crypto/b128ops.h:69 [inline]
xts_xor_tweak+0x4ae/0xbf0 crypto/xts.c:123
xts_xor_tweak_pre crypto/xts.c:135 [inline]
xts_encrypt+0x296/0x550 crypto/xts.c:268
crypto_skcipher_encrypt+0x1a0/0x1e0 crypto/skcipher.c:671
fscrypt_crypt_data_unit+0x4ee/0x8f0 fs/crypto/crypto.c:144
fscrypt_encrypt_pagecache_blocks+0x422/0x900 fs/crypto/crypto.c:207
ext4_bio_write_folio+0x13db/0x2e40 fs/ext4/page-io.c:526
mpage_submit_folio+0x351/0x4a0 fs/ext4/inode.c:1869
mpage_process_page_bufs+0xb92/0xe30 fs/ext4/inode.c:1982
mpage_process_folio fs/ext4/inode.c:2036 [inline]
mpage_map_and_submit_buffers fs/ext4/inode.c:2105 [inline]
mpage_map_and_submit_extent fs/ext4/inode.c:2254 [inline]
ext4_do_writepages+0x353e/0x62e0 fs/ext4/inode.c:2679
ext4_writepages+0x312/0x830 fs/ext4/inode.c:2768
do_writepages+0x427/0xc30 mm/page-writeback.c:2612
__writeback_single_inode+0x10d/0x12c0 fs/fs-writeback.c:1650
writeback_sb_inodes+0xb48/0x1be0 fs/fs-writeback.c:1941
wb_writeback+0x4a1/0xdf0 fs/fs-writeback.c:2117
wb_do_writeback fs/fs-writeback.c:2264 [inline]
wb_workfn+0x40b/0x1940 fs/fs-writeback.c:2304
process_one_work kernel/workqueue.c:3254 [inline]
process_scheduled_works+0xa81/0x1bd0 kernel/workqueue.c:3335
worker_thread+0xea5/0x1560 kernel/workqueue.c:3416
kthread+0x3e2/0x540 kernel/kthread.c:388
ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Uninit was created at:
__alloc_pages+0x9d6/0xe70 mm/page_alloc.c:4598
alloc_pages_mpol+0x299/0x990 mm/mempolicy.c:2264
alloc_pages mm/mempolicy.c:2335 [inline]
folio_alloc+0x1d0/0x230 mm/mempolicy.c:2342
filemap_alloc_folio+0xa6/0x440 mm/filemap.c:984
__filemap_get_folio+0xa10/0x14b0 mm/filemap.c:1926
ext4_write_begin+0x3e5/0x2230 fs/ext4/inode.c:1159
ext4_da_write_begin+0x4cd/0xec0 fs/ext4/inode.c:2869
generic_perform_write+0x400/0xc60 mm/filemap.c:3974
ext4_buffered_write_iter+0x564/0xaa0 fs/ext4/file.c:299
ext4_file_write_iter+0x208/0x3450
__kernel_write_iter+0x68b/0xc40 fs/read_write.c:523
__kernel_write+0xca/0x100 fs/read_write.c:543
__dump_emit fs/coredump.c:813 [inline]
dump_emit+0x3aa/0x5d0 fs/coredump.c:850
writenote+0x2ad/0x480 fs/binfmt_elf.c:1422
write_note_info fs/binfmt_elf.c:1912 [inline]
elf_core_dump+0x4f77/0x59c0 fs/binfmt_elf.c:2064
do_coredump+0x32d5/0x4920 fs/coredump.c:764
get_signal+0x267e/0x2d00 kernel/signal.c:2896
arch_do_signal_or_restart+0x53/0xcb0 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
irqentry_exit_to_user_mode+0xa6/0x160 kernel/entry/common.c:231
irqentry_exit+0x16/0x60 kernel/entry/common.c:334
exc_general_protection+0x2e6/0x4b0 arch/x86/kernel/traps.c:644
asm_exc_general_protection+0x2b/0x30 arch/x86/include/asm/idtentry.h:617

CPU: 0 PID: 57 Comm: kworker/u8:3 Not tainted 6.9.0-rc5-syzkaller-00329-g5d12ed4bea43 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: writeback wb_workfn (flush-7:1)
=====================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 45db3ab70092 Merge tag '6.9-rc7-ksmbd-fixes' of git://git...
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=14d9bfdf180000
kernel config: https://syzkaller.appspot.com/x/.config?x=617171361dd3cd47

dashboard link: https://syzkaller.appspot.com/bug?extid=aeb14e2539ffb6d21130
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1617adb8980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=112f45d4980000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/232e7c2a73a5/disk-45db3ab7.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7e9bf7c936ab/vmlinux-45db3ab7.xz
kernel image: https://storage.googleapis.com/syzbot-assets/5e8f98ee02d8/bzImage-45db3ab7.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/fcc88c919ed9/mount_1.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+aeb14e...@syzkaller.appspotmail.com

fscrypt: AES-256-XTS using implementation "xts(ecb(aes-fixed-time))"

=====================================================
BUG: KMSAN: uninit-value in subshift lib/crypto/aes.c:149 [inline]
BUG: KMSAN: uninit-value in aes_encrypt+0x15cc/0x1db0 lib/crypto/aes.c:282
subshift lib/crypto/aes.c:149 [inline]
aes_encrypt+0x15cc/0x1db0 lib/crypto/aes.c:282
aesti_encrypt+0x7d/0xf0 crypto/aes_ti.c:31
crypto_ecb_crypt crypto/ecb.c:23 [inline]
crypto_ecb_encrypt2+0x18a/0x300 crypto/ecb.c:40
crypto_lskcipher_crypt_sg+0x36b/0x7f0 crypto/lskcipher.c:228
crypto_lskcipher_encrypt_sg+0x8a/0xc0 crypto/lskcipher.c:247
crypto_skcipher_encrypt+0x119/0x1e0 crypto/skcipher.c:669
xts_encrypt+0x3c4/0x550 crypto/xts.c:269
crypto_skcipher_encrypt+0x1a0/0x1e0 crypto/skcipher.c:671
fscrypt_crypt_data_unit+0x4ee/0x8f0 fs/crypto/crypto.c:144
fscrypt_encrypt_pagecache_blocks+0x422/0x900 fs/crypto/crypto.c:207
ext4_bio_write_folio+0x13db/0x2e40 fs/ext4/page-io.c:526
mpage_submit_folio+0x351/0x4a0 fs/ext4/inode.c:1869
mpage_process_page_bufs+0xb92/0xe30 fs/ext4/inode.c:1982

mpage_prepare_extent_to_map+0x1702/0x22c0 fs/ext4/inode.c:2490
ext4_do_writepages+0x1117/0x62e0 fs/ext4/inode.c:2632

ext4_writepages+0x312/0x830 fs/ext4/inode.c:2768
do_writepages+0x427/0xc30 mm/page-writeback.c:2612

filemap_fdatawrite_wbc+0x1d8/0x270 mm/filemap.c:397
__filemap_fdatawrite_range mm/filemap.c:430 [inline]
file_write_and_wait_range+0x1bf/0x370 mm/filemap.c:788
generic_buffers_fsync_noflush+0x84/0x3e0 fs/buffer.c:602
ext4_fsync_nojournal fs/ext4/fsync.c:88 [inline]
ext4_sync_file+0x5ba/0x13a0 fs/ext4/fsync.c:151
vfs_fsync_range+0x20d/0x270 fs/sync.c:188
generic_write_sync include/linux/fs.h:2795 [inline]
ext4_buffered_write_iter+0x9ad/0xaa0 fs/ext4/file.c:305
ext4_file_write_iter+0x208/0x3450
call_write_iter include/linux/fs.h:2110 [inline]
new_sync_write fs/read_write.c:497 [inline]
vfs_write+0xb63/0x1520 fs/read_write.c:590
ksys_write+0x20f/0x4c0 fs/read_write.c:643
__do_sys_write fs/read_write.c:655 [inline]
__se_sys_write fs/read_write.c:652 [inline]
__x64_sys_write+0x93/0xe0 fs/read_write.c:652
x64_sys_call+0x3062/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:2
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
le128_xor include/crypto/b128ops.h:69 [inline]
xts_xor_tweak+0x4ae/0xbf0 crypto/xts.c:123
xts_xor_tweak_pre crypto/xts.c:135 [inline]
xts_encrypt+0x296/0x550 crypto/xts.c:268
crypto_skcipher_encrypt+0x1a0/0x1e0 crypto/skcipher.c:671
fscrypt_crypt_data_unit+0x4ee/0x8f0 fs/crypto/crypto.c:144
fscrypt_encrypt_pagecache_blocks+0x422/0x900 fs/crypto/crypto.c:207
ext4_bio_write_folio+0x13db/0x2e40 fs/ext4/page-io.c:526
mpage_submit_folio+0x351/0x4a0 fs/ext4/inode.c:1869
mpage_process_page_bufs+0xb92/0xe30 fs/ext4/inode.c:1982

mpage_prepare_extent_to_map+0x1702/0x22c0 fs/ext4/inode.c:2490
ext4_do_writepages+0x1117/0x62e0 fs/ext4/inode.c:2632

ext4_writepages+0x312/0x830 fs/ext4/inode.c:2768
do_writepages+0x427/0xc30 mm/page-writeback.c:2612

filemap_fdatawrite_wbc+0x1d8/0x270 mm/filemap.c:397
__filemap_fdatawrite_range mm/filemap.c:430 [inline]
file_write_and_wait_range+0x1bf/0x370 mm/filemap.c:788
generic_buffers_fsync_noflush+0x84/0x3e0 fs/buffer.c:602
ext4_fsync_nojournal fs/ext4/fsync.c:88 [inline]
ext4_sync_file+0x5ba/0x13a0 fs/ext4/fsync.c:151
vfs_fsync_range+0x20d/0x270 fs/sync.c:188
generic_write_sync include/linux/fs.h:2795 [inline]
ext4_buffered_write_iter+0x9ad/0xaa0 fs/ext4/file.c:305
ext4_file_write_iter+0x208/0x3450
call_write_iter include/linux/fs.h:2110 [inline]
new_sync_write fs/read_write.c:497 [inline]
vfs_write+0xb63/0x1520 fs/read_write.c:590
ksys_write+0x20f/0x4c0 fs/read_write.c:643
__do_sys_write fs/read_write.c:655 [inline]
__se_sys_write fs/read_write.c:652 [inline]
__x64_sys_write+0x93/0xe0 fs/read_write.c:652
x64_sys_call+0x3062/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:2
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
__alloc_pages+0x9d6/0xe70 mm/page_alloc.c:4598
alloc_pages_mpol+0x299/0x990 mm/mempolicy.c:2264
alloc_pages mm/mempolicy.c:2335 [inline]
folio_alloc+0x1d0/0x230 mm/mempolicy.c:2342
filemap_alloc_folio+0xa6/0x440 mm/filemap.c:984
__filemap_get_folio+0xa10/0x14b0 mm/filemap.c:1926
ext4_write_begin+0x3e5/0x2230 fs/ext4/inode.c:1159

generic_perform_write+0x400/0xc60 mm/filemap.c:3974
ext4_buffered_write_iter+0x564/0xaa0 fs/ext4/file.c:299
ext4_file_write_iter+0x208/0x3450

call_write_iter include/linux/fs.h:2110 [inline]
new_sync_write fs/read_write.c:497 [inline]
vfs_write+0xb63/0x1520 fs/read_write.c:590
ksys_write+0x20f/0x4c0 fs/read_write.c:643
__do_sys_write fs/read_write.c:655 [inline]
__se_sys_write fs/read_write.c:652 [inline]
__x64_sys_write+0x93/0xe0 fs/read_write.c:652
x64_sys_call+0x3062/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:2
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 0 PID: 5048 Comm: syz-executor132 Not tainted 6.9.0-rc7-syzkaller-00056-g45db3ab70092 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
=====================================================


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

[Herbert Xu]

#syz set subsystems: ext4

These reports have been coming in for a while, previously they were
merged incorrectly with reports coming from networking, see for
example:

https://syzkaller.appspot.com/bug?id=6eb713b7107c62e9f6c259adf944c96efc3cd524
https://syzkaller.appspot.com/text?tag=CrashReport&x=11e16a77a80000

The networking bug disappeared mysteriously in July 2023.

Thanks,
--
Email: Herbert Xu <her...@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.

***

Subject: ff/ext4: Prevent crypto operation on unaligned blocks
Author: nork...@gmail.com

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 45db3ab70092637967967bfd8e6144017638563c

syzbot is reporting an uninitialized value in aes_encrypt(). The block
cipher expects the bytes to encrypt or decrypt to be a multiple of the
cipher's block size. However, when ext4_write_begin() is called and new
folios are allocated and they might not be aligned to the required block
size.

To ensure that padding bytes are automatically initialized in
the ext4_write_begin, this patch adds __GFP_ZERO to the existing GFP
masks. This adjustment is applied only when the CONFIG_FS_ENCRYPTION
is defined.

Closes: https://syzkaller.appspot.com/bug?extid=aeb14e2539ffb6d21130
Signed-off-by: Norbert Kamiński <nork...@gmail.com>
---
fs/ext4/inode.c | 6 ++++++
1 file changed, 6 insertions(+)

diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 4bae9ccf5fe0..1a8e47221e72 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -1156,6 +1156,9 @@ static int ext4_write_begin(struct file *file, struct address_space *mapping,
* the folio (if needed) without using GFP_NOFS.
*/
retry_grab:
+#ifdef CONFIG_FS_ENCRYPTION
+ mapping_set_gfp_mask(mapping, mapping_gfp_mask(mapping) | __GFP_ZERO);
+#endif
folio = __filemap_get_folio(mapping, index, FGP_WRITEBEGIN,
mapping_gfp_mask(mapping));
if (IS_ERR(folio))
@@ -2882,6 +2885,9 @@ static int ext4_da_write_begin(struct file *file, struct address_space *mapping,
}

retry:
+#ifdef CONFIG_FS_ENCRYPTION
+ mapping_set_gfp_mask(mapping, mapping_gfp_mask(mapping) | __GFP_ZERO);
+#endif
folio = __filemap_get_folio(mapping, index, FGP_WRITEBEGIN,
mapping_gfp_mask(mapping));
if (IS_ERR(folio))
--
2.34.1

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
SYZFAIL: NL802154_CMD_SET_SHORT_ADDR failed

2024/06/05 22:43:18 ignoring optional flag "sandboxArg"="0"
2024/06/05 22:43:18 parsed 1 programs
2024/06/05 22:43:18 [FATAL] failed to run ["./syz-executor" "setup" "fault" "binfmt_misc" "usb" "802154" "swap"]: exit status 67
mkdir(/syzcgroup) failed: 17
mount(binfmt_misc) failed: 16
SYZFAIL: NL802154_CMD_SET_SHORT_ADDR failed
(errno 16: Device or resource busy)


Tested on:

commit: 45db3ab7 Merge tag '6.9-rc7-ksmbd-fixes' of git://git...
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=15a9ec0a980000

kernel config: https://syzkaller.appspot.com/x/.config?x=617171361dd3cd47
dashboard link: https://syzkaller.appspot.com/bug?extid=aeb14e2539ffb6d21130
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=10414bc2980000

[syzbot]

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
SYZFAIL: NL802154_CMD_SET_SHORT_ADDR failed

2024/06/06 06:33:50 ignoring optional flag "sandboxArg"="0"
2024/06/06 06:33:51 parsed 1 programs
2024/06/06 06:33:52 [FATAL] failed to run ["./syz-executor" "setup" "fault" "binfmt_misc" "usb" "802154" "swap"]: exit status 67

mkdir(/syzcgroup) failed: 17
mount(binfmt_misc) failed: 16
SYZFAIL: NL802154_CMD_SET_SHORT_ADDR failed
(errno 16: Device or resource busy)


Tested on:

commit: 45db3ab7 Merge tag '6.9-rc7-ksmbd-fixes' of git://git...
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

console output: https://syzkaller.appspot.com/x/log.txt?x=1555cbaa980000

kernel config: https://syzkaller.appspot.com/x/.config?x=617171361dd3cd47
dashboard link: https://syzkaller.appspot.com/bug?extid=aeb14e2539ffb6d21130
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=12cf4aac980000

[syzbot]

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
SYZFAIL: NL802154_CMD_SET_SHORT_ADDR failed

2024/06/06 08:15:57 ignoring optional flag "sandboxArg"="0"
2024/06/06 08:15:58 parsed 1 programs
2024/06/06 08:15:58 [FATAL] failed to run ["./syz-executor" "setup" "fault" "binfmt_misc" "usb" "802154" "swap"]: exit status 67

mkdir(/syzcgroup) failed: 17
mount(binfmt_misc) failed: 16
SYZFAIL: NL802154_CMD_SET_SHORT_ADDR failed
(errno 16: Device or resource busy)


Tested on:

commit: 45db3ab7 Merge tag '6.9-rc7-ksmbd-fixes' of git://git...
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

console output: https://syzkaller.appspot.com/x/log.txt?x=177f3096980000

kernel config: https://syzkaller.appspot.com/x/.config?x=617171361dd3cd47
dashboard link: https://syzkaller.appspot.com/bug?extid=aeb14e2539ffb6d21130
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=1211f026980000

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.

***

Subject: [syzbot] [ext4] KMSAN: uninit-value in aes_encrypt (5)
Author: nork...@gmail.com

#syz test

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

d greatest stack depth: 8144 bytes left
[ 54.409458][ T4445] EXT4-fs (sda1): re-mounted 5941fea2-f5fa-4b4e-b5ef-9af118b27b95 r/w. Quota mode: none.
mount: mounting smackfs on /sys/fs/smackfs failed: No such file or directory
mount: mounting selinuxfs on /sys/fs/selinux failed: No such file or directory
[ 54.752888][ T4448] mount (4448) used greatest stack depth: 5568 bytes left
Starting syslogd: OK
Starting acpid: OK
Starting klogd: OK
Running sysctl: OK
Populating /dev using udev: [ 58.568520][ T4478] udevd[4478]: starting version 3.2.11
[ 62.084670][ T4479] udevd[4479]: starting eudev-3.2.11
[ 62.097228][ T4478] udevd (4478) used greatest stack depth: 5160 bytes left
[ 96.250159][ T1225] net_ratelimit: 2 callbacks suppressed
[ 96.250230][ T1225] aoe: packet could not be sent on lo. consider increasing tx_queue_len
[ 96.265039][ T1225] aoe: packet could not be sent on bond0. consider increasing tx_queue_len
[ 96.274247][ T1225] aoe: packet could not be sent on dummy0. consider increasing tx_queue_len
[ 96.283534][ T1225] aoe: packet could not be sent on eql. consider increasing tx_queue_len
[ 96.292534][ T1225] aoe: packet could not be sent on ifb0. consider increasing tx_queue_len
[ 96.301553][ T1225] aoe: packet could not be sent on ifb1. consider increasing tx_queue_len
[ 96.311305][ T1225] aoe: packet could not be sent on eth0. consider increasing tx_queue_len
[ 96.320356][ T1225] aoe: packet could not be sent on wlan0. consider increasing tx_queue_len
[ 96.329652][ T1225] aoe: packet could not be sent on wlan1. consider increasing tx_queue_len
[ 96.338843][ T1225] aoe: packet could not be sent on hwsim0. consider increasing tx_queue_len
done
Starting system message bus: done
Starting iptables: OK
Starting network: OK
Starting dhcpcd...
dhcpcd-9.4.1 starting
dev: loaded udev
DUID 00:04:c7:fd:4a:df:9d:a6:e9:60:55:7b:b4:5b:1f:77:00:5c
forked to background, child pid 4692
[ 109.206454][ T4693] 8021q: adding VLAN 0 to HW filter on device bond0
[ 109.248494][ T4693] eql: remember to turn off Van-Jacobson compression on your slave devices
[ 110.193163][ C0] =====================================================
[ 110.200570][ C0] BUG: KMSAN: uninit-value in receive_buf+0x25e3/0x5fd0
[ 110.207866][ C0] receive_buf+0x25e3/0x5fd0
[ 110.212658][ C0] virtnet_poll+0xd1c/0x23c0
[ 110.217587][ C0] __napi_poll+0xe7/0x980
[ 110.222127][ C0] net_rx_action+0x82a/0x1850
[ 110.227132][ C0] handle_softirqs+0x1ce/0x800
[ 110.232093][ C0] __irq_exit_rcu+0x68/0x120
[ 110.236963][ C0] irq_exit_rcu+0x12/0x20
[ 110.241471][ C0] common_interrupt+0x94/0xa0
[ 110.246533][ C0] asm_common_interrupt+0x2b/0x40
[ 110.251753][ C0] virt_to_page_or_null+0x63/0x150
[ 110.257214][ C0] kmsan_get_metadata+0x146/0x1d0
[ 110.262426][ C0] kmsan_get_shadow_origin_ptr+0x38/0xb0
[ 110.268508][ C0] __msan_metadata_ptr_for_store_4+0x27/0x40
[ 110.274681][ C0] sha256_transform_blocks+0xb62/0x2e90
[ 110.280603][ C0] sha256_update+0x2ff/0x340
[ 110.285390][ C0] crypto_sha256_update+0x37/0x60
[ 110.290776][ C0] crypto_shash_update+0x79/0xa0
[ 110.295878][ C0] ima_calc_file_hash+0x180a/0x3c90
[ 110.301343][ C0] ima_collect_measurement+0x473/0xd30
[ 110.307116][ C0] process_measurement+0x295d/0x3f50
[ 110.312632][ C0] ima_file_check+0xb4/0x100
[ 110.317592][ C0] security_file_post_open+0x9c/0x150
[ 110.323195][ C0] path_openat+0x4da5/0x5b70
[ 110.328116][ C0] do_filp_open+0x20e/0x590
[ 110.332790][ C0] do_sys_openat2+0x1bf/0x2f0
[ 110.337769][ C0] __x64_sys_openat+0x2a1/0x310
[ 110.342834][ C0] x64_sys_call+0x128b/0x3b90
[ 110.347880][ C0] do_syscall_64+0xcd/0x1e0
[ 110.352571][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 110.359359][ C0]
[ 110.361772][ C0] Uninit was created at:
[ 110.366321][ C0] __alloc_pages_noprof+0x9d6/0xe70
[ 110.371715][ C0] alloc_pages_mpol_noprof+0x299/0x990
[ 110.377535][ C0] alloc_pages_noprof+0x1bf/0x1e0
[ 110.382768][ C0] skb_page_frag_refill+0x2bf/0x7c0
[ 110.388295][ C0] virtnet_rq_alloc+0x43/0xbb0
[ 110.393231][ C0] try_fill_recv+0x3f0/0x2f50
[ 110.398234][ C0] virtnet_open+0x1cc/0xb00
[ 110.402950][ C0] __dev_open+0x546/0x6f0
[ 110.407526][ C0] __dev_change_flags+0x309/0x9a0
[ 110.412731][ C0] dev_change_flags+0x8e/0x1d0
[ 110.417804][ C0] devinet_ioctl+0x13ec/0x22c0
[ 110.422782][ C0] inet_ioctl+0x4bd/0x6d0
[ 110.427442][ C0] sock_do_ioctl+0xb7/0x540
[ 110.432118][ C0] sock_ioctl+0x727/0xd70
[ 110.436760][ C0] __se_sys_ioctl+0x261/0x450
[ 110.441605][ C0] __x64_sys_ioctl+0x96/0xe0
[ 110.446445][ C0] x64_sys_call+0x18c0/0x3b90
[ 110.451323][ C0] do_syscall_64+0xcd/0x1e0
[ 110.456170][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 110.462269][ C0]
[ 110.464785][ C0] CPU: 0 PID: 4771 Comm: ssh-keygen Not tainted 6.10.0-rc2-syzkaller-00097-g2df0193e62cf #0
[ 110.475212][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
[ 110.485516][ C0] =====================================================
[ 110.492710][ C0] Disabling lock debugging due to kernel taint
[ 110.499145][ C0] Kernel panic - not syncing: kmsan.panic set ...
[ 110.505681][ C0] CPU: 0 PID: 4771 Comm: ssh-keygen Tainted: G B 6.10.0-rc2-syzkaller-00097-g2df0193e62cf #0
[ 110.517420][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
[ 110.527734][ C0] Call Trace:
[ 110.531227][ C0] <IRQ>
[ 110.534184][ C0] dump_stack_lvl+0x216/0x2d0
[ 110.539062][ C0] ? kmsan_get_shadow_origin_ptr+0x4d/0xb0
[ 110.545091][ C0] dump_stack+0x1e/0x30
[ 110.549446][ C0] panic+0x4e2/0xcd0
[ 110.553533][ C0] ? kmsan_get_metadata+0xe1/0x1d0
[ 110.558872][ C0] kmsan_report+0x2d5/0x2e0
[ 110.563577][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 110.568991][ C0] ? kmsan_get_shadow_origin_ptr+0x4d/0xb0
[ 110.575052][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 110.580462][ C0] ? __msan_warning+0x95/0x120
[ 110.585421][ C0] ? receive_buf+0x25e3/0x5fd0
[ 110.590382][ C0] ? virtnet_poll+0xd1c/0x23c0
[ 110.595344][ C0] ? __napi_poll+0xe7/0x980
[ 110.600064][ C0] ? net_rx_action+0x82a/0x1850
[ 110.605087][ C0] ? handle_softirqs+0x1ce/0x800
[ 110.610229][ C0] ? __irq_exit_rcu+0x68/0x120
[ 110.615183][ C0] ? irq_exit_rcu+0x12/0x20
[ 110.619871][ C0] ? common_interrupt+0x94/0xa0
[ 110.624976][ C0] ? asm_common_interrupt+0x2b/0x40
[ 110.630393][ C0] ? virt_to_page_or_null+0x63/0x150
[ 110.635888][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 110.641295][ C0] ? kmsan_get_shadow_origin_ptr+0x38/0xb0
[ 110.647335][ C0] ? __msan_metadata_ptr_for_store_4+0x27/0x40
[ 110.653702][ C0] ? sha256_transform_blocks+0xb62/0x2e90
[ 110.659653][ C0] ? sha256_update+0x2ff/0x340
[ 110.664710][ C0] ? crypto_sha256_update+0x37/0x60
[ 110.670235][ C0] ? crypto_shash_update+0x79/0xa0
[ 110.675963][ C0] ? ima_calc_file_hash+0x180a/0x3c90
[ 110.681516][ C0] ? ima_collect_measurement+0x473/0xd30
[ 110.687335][ C0] ? process_measurement+0x295d/0x3f50
[ 110.693021][ C0] ? ima_file_check+0xb4/0x100
[ 110.698199][ C0] ? security_file_post_open+0x9c/0x150
[ 110.703983][ C0] ? path_openat+0x4da5/0x5b70
[ 110.708912][ C0] ? do_filp_open+0x20e/0x590
[ 110.713692][ C0] ? do_sys_openat2+0x1bf/0x2f0
[ 110.718671][ C0] ? __x64_sys_openat+0x2a1/0x310
[ 110.723932][ C0] ? x64_sys_call+0x128b/0x3b90
[ 110.728920][ C0] ? do_syscall_64+0xcd/0x1e0
[ 110.734054][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 110.740238][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 110.745543][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 110.750847][ C0] ? page_to_skb+0xdae/0x1620
[ 110.755639][ C0] __msan_warning+0x95/0x120
[ 110.760340][ C0] receive_buf+0x25e3/0x5fd0
[ 110.765033][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 110.770447][ C0] ? kmsan_get_shadow_origin_ptr+0x4d/0xb0
[ 110.776424][ C0] virtnet_poll+0xd1c/0x23c0
[ 110.781146][ C0] ? __pfx_virtnet_poll+0x10/0x10
[ 110.786270][ C0] __napi_poll+0xe7/0x980
[ 110.790708][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 110.796015][ C0] net_rx_action+0x82a/0x1850
[ 110.800811][ C0] ? sched_clock_cpu+0x55/0x870
[ 110.805780][ C0] ? __pfx_net_rx_action+0x10/0x10
[ 110.811008][ C0] handle_softirqs+0x1ce/0x800
[ 110.815973][ C0] __irq_exit_rcu+0x68/0x120
[ 110.820694][ C0] irq_exit_rcu+0x12/0x20
[ 110.825140][ C0] common_interrupt+0x94/0xa0
[ 110.829944][ C0] </IRQ>
[ 110.832924][ C0] <TASK>
[ 110.835905][ C0] asm_common_interrupt+0x2b/0x40
[ 110.841045][ C0] RIP: 0010:virt_to_page_or_null+0x63/0x150
[ 110.847064][ C0] Code: cc cc 48 3d ff ff ff 1f 77 f0 48 8b 15 c6 de c1 0e 48 01 c2 65 ff 05 34 ad c4 7d 31 c9 48 89 d6 48 c1 ee 2e 0f 85 86 00 00 00 <48> 8b 0d 7e bb a6 11 48 85 c9 74 23 48 89 d6 48 c1 ee 23 48 8b 34
[ 110.867148][ C0] RSP: 0018:ffff88811fc72d98 EFLAGS: 00000246
[ 110.873309][ C0] RAX: ffff88819fc73070 RBX: ffff88811fc73070 RCX: 0000000000000000
[ 110.881392][ C0] RDX: 000000011fc73070 RSI: 0000000000000000 RDI: ffff88811fc73070
[ 110.889444][ C0] RBP: ffff88811fc72d98 R08: ffffea000000000f R09: 000000007c17d933
[ 110.897494][ C0] R10: 0000000000000000 R11: 00000000011600cf R12: 0000000000000000
[ 110.905549][ C0] R13: 00000000b7197e49 R14: 0000000000000000 R15: ffff88811fc73070
[ 110.913623][ C0] kmsan_get_metadata+0x146/0x1d0
[ 110.918772][ C0] kmsan_get_shadow_origin_ptr+0x38/0xb0
[ 110.924553][ C0] __msan_metadata_ptr_for_store_4+0x27/0x40
[ 110.930658][ C0] sha256_transform_blocks+0xb62/0x2e90
[ 110.936383][ C0] sha256_update+0x2ff/0x340
[ 110.941127][ C0] crypto_sha256_update+0x37/0x60
[ 110.946270][ C0] ? __pfx_crypto_sha256_update+0x10/0x10
[ 110.952110][ C0] crypto_shash_update+0x79/0xa0
[ 110.957145][ C0] ima_calc_file_hash+0x180a/0x3c90
[ 110.962433][ C0] ? kmsan_get_shadow_origin_ptr+0x4d/0xb0
[ 110.968379][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 110.973710][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 110.979030][ C0] ? kmsan_get_shadow_origin_ptr+0x4d/0xb0
[ 110.984967][ C0] ? generic_fillattr+0x568/0x820
[ 110.990125][ C0] ? ext4_getattr+0xcba/0x1010
[ 110.994998][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 111.000313][ C0] ? kmsan_get_shadow_origin_ptr+0x4d/0xb0
[ 111.006267][ C0] ? ext4_file_getattr+0x27f/0x3f0
[ 111.011551][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 111.016855][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 111.022199][ C0] ? kmsan_get_shadow_origin_ptr+0x4d/0xb0
[ 111.028414][ C0] ima_collect_measurement+0x473/0xd30
[ 111.033987][ C0] ? __pfx_ext4_xattr_security_get+0x10/0x10
[ 111.040104][ C0] ? vfs_getxattr_alloc+0xb3b/0xc10
[ 111.045424][ C0] process_measurement+0x295d/0x3f50
[ 111.050857][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 111.056197][ C0] ? ima_file_check+0x41/0x100
[ 111.061175][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 111.066491][ C0] ? kmsan_get_shadow_origin_ptr+0x4d/0xb0
[ 111.072421][ C0] ? end_current_label_crit_section+0x124/0x2a0
[ 111.078813][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 111.084160][ C0] ? kmsan_get_shadow_origin_ptr+0x4d/0xb0
[ 111.090080][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 111.095379][ C0] ? kmsan_get_shadow_origin_ptr+0x4d/0xb0
[ 111.101380][ C0] ima_file_check+0xb4/0x100
[ 111.106112][ C0] ? __pfx_ima_file_check+0x10/0x10
[ 111.111487][ C0] security_file_post_open+0x9c/0x150
[ 111.116988][ C0] path_openat+0x4da5/0x5b70
[ 111.121704][ C0] do_filp_open+0x20e/0x590
[ 111.126417][ C0] do_sys_openat2+0x1bf/0x2f0
[ 111.131210][ C0] __x64_sys_openat+0x2a1/0x310
[ 111.136184][ C0] x64_sys_call+0x128b/0x3b90
[ 111.140994][ C0] do_syscall_64+0xcd/0x1e0
[ 111.145640][ C0] ? clear_bhb_loop+0x25/0x80
[ 111.150465][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 111.156495][ C0] RIP: 0033:0x7f5bc4066a46
[ 111.160991][ C0] Code: 10 00 00 00 44 8b 54 24 e0 48 89 44 24 c0 48 8d 44 24 d0 48 89 44 24 c8 44 89 c2 4c 89 ce bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 76 0c f7 d8 89 05 0a 48 01 00 48 83 c8 ff c3 31
[ 111.180724][ C0] RSP: 002b:00007ffeb8e017b8 EFLAGS: 00000287 ORIG_RAX: 0000000000000101
[ 111.189424][ C0] RAX: ffffffffffffffda RBX: 00007ffeb8e01a18 RCX: 00007f5bc4066a46
[ 111.197479][ C0] RDX: 0000000000080000 RSI: 00007ffeb8e01830 RDI: 00000000ffffff9c
[ 111.205522][ C0] RBP: 00007ffeb8e01820 R08: 0000000000080000 R09: 00007ffeb8e01830
[ 111.213573][ C0] R10: 0000000000000000 R11: 0000000000000287 R12: 00007ffeb8e01830
[ 111.221646][ C0] R13: 0000000000000009 R14: 00007ffeb8e019ff R15: 00000000ffffffff
[ 111.229808][ C0] </TASK>
[ 111.233238][ C0] Kernel Offset: disabled
[ 111.237626][ C0] Rebooting in 86400 seconds..


syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.21.4'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build1950147168=/tmp/go-build -gno-record-gcc-switches'

git status (err=<nil>)
HEAD detached at de979bc20b
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=de979bc20b2b73242b7d6fbbdf614a8cb4c574f4 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240509-085021'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=de979bc20b2b73242b7d6fbbdf614a8cb4c574f4 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240509-085021'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
gcc -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -std=c++11 -I. -Iexecutor/_include -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"de979bc20b2b73242b7d6fbbdf614a8cb4c574f4\"


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=13d54aba980000


Tested on:

commit: 2df0193e Merge tag 'thermal-6.10-rc3' of git://git.ker..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=df1f4f8393ab939d

dashboard link: https://syzkaller.appspot.com/bug?extid=aeb14e2539ffb6d21130
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

Note: no patches were applied.

[syzbot]

#syz test:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
45db3ab70092637967967bfd8e6144017638563c

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
SYZFAIL: NL802154_CMD_SET_SHORT_ADDR failed

2024/06/06 11:12:56 ignoring optional flag "sandboxArg"="0"
2024/06/06 11:12:57 parsed 1 programs
2024/06/06 11:12:57 [FATAL] failed to run ["./syz-executor" "setup" "fault" "binfmt_misc" "usb" "802154" "swap"]: exit status 67

mkdir(/syzcgroup) failed: 17
mount(binfmt_misc) failed: 16
SYZFAIL: NL802154_CMD_SET_SHORT_ADDR failed
(errno 16: Device or resource busy)


Tested on:

commit: 45db3ab7 Merge tag '6.9-rc7-ksmbd-fixes' of git://git...
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

console output: https://syzkaller.appspot.com/x/log.txt?x=13e682ce980000
kernel config: https://syzkaller.appspot.com/x/.config?x=617171361dd3cd47