KMSAN: uninit-value in ip6_tnl_start_xmit

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: d2d741e5d189 kmsan: add initialization for shmem pages
git tree: https://github.com/google/kmsan.git/master
console output: https://syzkaller.appspot.com/x/log.txt?x=14094a57800000
kernel config: https://syzkaller.appspot.com/x/.config?x=48f9de3384bcd0f
dashboard link: https://syzkaller.appspot.com/bug?extid=3fde91d4d394747d6db4
compiler: clang version 7.0.0 (trunk 329391)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17919a47800000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13598fbb800000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+3fde91...@syzkaller.appspotmail.com

IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
8021q: adding VLAN 0 to HW filter on device team0
==================================================================
BUG: KMSAN: uninit-value in ip6ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1307
[inline]
BUG: KMSAN: uninit-value in ip6_tnl_start_xmit+0x7d2/0x1ef0
net/ipv6/ip6_tunnel.c:1390
CPU: 0 PID: 4504 Comm: syz-executor558 Not tainted 4.16.0+ #87
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x185/0x1d0 lib/dump_stack.c:53
kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067
__msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:683
ip6ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1307 [inline]
ip6_tnl_start_xmit+0x7d2/0x1ef0 net/ipv6/ip6_tunnel.c:1390
__netdev_start_xmit include/linux/netdevice.h:4066 [inline]
netdev_start_xmit include/linux/netdevice.h:4075 [inline]
xmit_one net/core/dev.c:3026 [inline]
dev_hard_start_xmit+0x5f1/0xc70 net/core/dev.c:3042
__dev_queue_xmit+0x27ee/0x3520 net/core/dev.c:3557
dev_queue_xmit+0x4b/0x60 net/core/dev.c:3590
packet_snd net/packet/af_packet.c:2944 [inline]
packet_sendmsg+0x7c70/0x8a30 net/packet/af_packet.c:2969
sock_sendmsg_nosec net/socket.c:630 [inline]
sock_sendmsg net/socket.c:640 [inline]
___sys_sendmsg+0xec0/0x1310 net/socket.c:2046
__sys_sendmmsg+0x42d/0x800 net/socket.c:2136
SYSC_sendmmsg+0xc4/0x110 net/socket.c:2167
SyS_sendmmsg+0x63/0x90 net/socket.c:2162
do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x3d/0xa2
RIP: 0033:0x441819
RSP: 002b:00007ffe58ee8268 EFLAGS: 00000213 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000441819
RDX: 0000000000000002 RSI: 0000000020000100 RDI: 0000000000000003
RBP: 00000000006cd018 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000213 R12: 0000000000402510
R13: 00000000004025a0 R14: 0000000000000000 R15: 0000000000000000

Uninit was created at:
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline]
kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:188
kmsan_kmalloc+0x94/0x100 mm/kmsan/kmsan.c:314
kmsan_slab_alloc+0x11/0x20 mm/kmsan/kmsan.c:321
slab_post_alloc_hook mm/slab.h:445 [inline]
slab_alloc_node mm/slub.c:2737 [inline]
__kmalloc_node_track_caller+0xaed/0x11c0 mm/slub.c:4369
__kmalloc_reserve net/core/skbuff.c:138 [inline]
__alloc_skb+0x2cf/0x9f0 net/core/skbuff.c:206
alloc_skb include/linux/skbuff.h:984 [inline]
alloc_skb_with_frags+0x1d4/0xb20 net/core/skbuff.c:5234
sock_alloc_send_pskb+0xb56/0x1190 net/core/sock.c:2085
packet_alloc_skb net/packet/af_packet.c:2803 [inline]
packet_snd net/packet/af_packet.c:2894 [inline]
packet_sendmsg+0x6454/0x8a30 net/packet/af_packet.c:2969
sock_sendmsg_nosec net/socket.c:630 [inline]
sock_sendmsg net/socket.c:640 [inline]
___sys_sendmsg+0xec0/0x1310 net/socket.c:2046
__sys_sendmmsg+0x42d/0x800 net/socket.c:2136
SYSC_sendmmsg+0xc4/0x110 net/socket.c:2167
SyS_sendmmsg+0x63/0x90 net/socket.c:2162
do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x3d/0xa2
==================================================================


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches

[Paolo Abeni]

#syz test: https://github.com/google/kmsan.git master
--
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 419960b0ba16..a0b6932c3afd 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1234,7 +1234,7 @@ static inline int
ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
{
struct ip6_tnl *t = netdev_priv(dev);
- const struct iphdr *iph = ip_hdr(skb);
+ const struct iphdr *iph;
int encap_limit = -1;
struct flowi6 fl6;
__u8 dsfield;
@@ -1242,6 +1242,11 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
u8 tproto;
int err;

+ /* ensure we can access the full inner ip header */
+ if (!pskb_may_pull(skb, sizeof(struct iphdr)))
+ return -1;
+
+ iph = ip_hdr(skb);
memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));

tproto = READ_ONCE(t->parms.proto);
@@ -1306,7 +1311,7 @@ static inline int
ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
{
struct ip6_tnl *t = netdev_priv(dev);
- struct ipv6hdr *ipv6h = ipv6_hdr(skb);
+ struct ipv6hdr *ipv6h;
int encap_limit = -1;
__u16 offset;
struct flowi6 fl6;
@@ -1315,6 +1320,10 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
u8 tproto;
int err;

+ if (unlikely(!pskb_may_pull(skb, sizeof(*ipv6h))))
+ return -1;
+
+ ipv6h = ipv6_hdr(skb);
tproto = READ_ONCE(t->parms.proto);
if ((tproto != IPPROTO_IPV6 && tproto != 0) ||
ip6_tnl_addr_conflict(t, ipv6h))

[syzbot]

Hello,

syzbot tried to test the proposed patch but build/boot failed:

^~~~~~~~
In file included from kernel/compat.c:15:
In file included from ./include/linux/compat.h:12:
In file included from ./include/linux/stat.h:19:
In file included from ./include/linux/time.h:6:
In file included from ./include/linux/seqlock.h:36:
In file included from ./include/linux/spinlock.h:58:
./include/linux/bottom_half.h:32:23: warning: returning address of label,
which is local [-Wreturn-stack-address]
__local_bh_enable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
^~~~~~~~~
./include/linux/kernel.h:204:64: note: expanded from macro '_THIS_IP_'
#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~
CC kernel/trace/trace_nop.o
In file included from lib/checksum.c:36:
In file included from ./include/net/checksum.h:25:
In file included from ./include/linux/uaccess.h:5:
In file included from ./include/linux/sched.h:14:
In file included from ./include/linux/pid.h:5:
In file included from ./include/linux/rculist.h:11:
In file included from ./include/linux/rcupdate.h:41:
./include/linux/bottom_half.h:19:24: warning: returning address of label,
which is local [-Wreturn-stack-address]
__local_bh_disable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
^~~~~~~~~
./include/linux/kernel.h:204:64: note: expanded from macro '_THIS_IP_'
#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~
In file included from lib/checksum.c:36:
In file included from ./include/net/checksum.h:25:
In file included from ./include/linux/uaccess.h:5:
In file included from ./include/linux/sched.h:14:
In file included from ./include/linux/pid.h:5:
In file included from ./include/linux/rculist.h:11:
In file included from ./include/linux/rcupdate.h:41:
./include/linux/bottom_half.h:32:23: warning: returning address of label,
which is local [-Wreturn-stack-address]
__local_bh_enable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
^~~~~~~~~
./include/linux/kernel.h:204:64: note: expanded from macro '_THIS_IP_'
#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~
CC drivers/edac/wq.o
CC kernel/sched/wait_bit.o
In file included from 2 warnings generated.
kernel/utsname.c:14:
In file included from ./include/linux/utsname.h:6:
In file included from ./include/linux/sched.h:14:
In file included from ./include/linux/pid.h:5:
In file included from ./include/linux/rculist.h:11:
In file included from ./include/linux/rcupdate.h:41:
./include/linux/bottom_half.h:19:24: warning: returning address of label,
which is local [-Wreturn-stack-address]
__local_bh_disable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
^~~~~~~~~
./include/linux/kernel.h:204:64: note: expanded from macro '_THIS_IP_'
#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~
In file included from kernel/utsname.c:14:
In file included from ./include/linux/utsname.h:6:
In file included from ./include/linux/sched.h:14:
In file included from ./include/linux/pid.h:5:
In file included from ./include/linux/rculist.h:11:
In file included from ./include/linux/rcupdate.h:41:
./include/linux/bottom_half.h:32:23: warning: returning address of label,
which is local [-Wreturn-stack-address]
__local_bh_enable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
^~~~~~~~~
./include/linux/kernel.h:204:64: note: expanded from macro '_THIS_IP_'
#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~
In file included from lib/cpu_rmap.c:10:
In file included from ./include/linux/cpu_rmap.h:14:
In file included from ./include/linux/gfp.h:6:
In file included from ./include/linux/mmzone.h:8:
In file included from ./include/linux/spinlock.h:58:
./include/linux/bottom_half.h:19:24: warning: returning address of label,
which is local [-Wreturn-stack-address]
__local_bh_disable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
^~~~~~~~~
./include/linux/kernel.h:204:64: note: expanded from macro '_THIS_IP_'
#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~
In file included from lib/cpu_rmap.c:10:
In file included from ./include/linux/cpu_rmap.h:14:
In file included from ./include/linux/gfp.h:6:
In file included from ./include/linux/mmzone.h:8:
In file included from ./include/linux/spinlock.h:58:
./include/linux/bottom_half.h:32:23: warning: returning address of label,
which is local [-Wreturn-stack-address]
__local_bh_enable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
^~~~~~~~~
./include/linux/kernel.h:204:64: note: expanded from macro '_THIS_IP_'
#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~
2 warnings generated.
In file included from lib/nlattr.c:12:
In file included from ./include/linux/jiffies.h:9:
In file included from ./include/linux/time.h:6:
In file included from ./include/linux/seqlock.h:36:
In file included from ./include/linux/spinlock.h:58:
./include/linux/bottom_half.h:19:24: warning: returning address of label,
which is local [-Wreturn-stack-address]
__local_bh_disable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
^~~~~~~~~
./include/linux/kernel.h:204:64: note: expanded from macro '_THIS_IP_'
#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~
In file included from lib/nlattr.c:12:
In file included from ./include/linux/jiffies.h:9:
In file included from ./include/linux/time.h:6:
In file included from ./include/linux/seqlock.h:36:
In file included from ./include/linux/spinlock.h:58:
./include/linux/bottom_half.h:32:23: warning: returning address of label,
which is local [-Wreturn-stack-address]
__local_bh_enable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
^~~~~~~~~
./include/linux/kernel.h:204:64: note: expanded from macro '_THIS_IP_'
#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~
2 warnings generated.
2 warnings generated.
In file included from lib/syscall.c:2:
In file included from ./include/linux/ptrace.h:6:
In file included from ./include/linux/sched.h:14:
In file included from ./include/linux/pid.h:5:
In file included from ./include/linux/rculist.h:11:
In file included from ./include/linux/rcupdate.h:41:
./include/linux/bottom_half.h:19:24: warning: returning address of label,
which is local [-Wreturn-stack-address]
__local_bh_disable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
^~~~~~~~~
./include/linux/kernel.h:204:64: note: expanded from macro '_THIS_IP_'
#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~
In file included from lib/syscall.c:2:
In file included from ./include/linux/ptrace.h:6:
In file included from ./include/linux/sched.h:14:
In file included from ./include/linux/pid.h:5:
In file included from ./include/linux/rculist.h:11:
In file included from ./include/linux/rcupdate.h:41:
./include/linux/bottom_half.h:32:23: warning: returning address of label,
which is local [-Wreturn-stack-address]
__local_bh_enable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
^~~~~~~~~
./include/linux/kernel.h:204:64: note: expanded from macro '_THIS_IP_'
#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~
In file included from drivers/i2c/algos/i2c-algo-bit.c:21:
In file included from ./include/linux/module.h:10:
In file included from ./include/linux/stat.h:19:
In file included from ./include/linux/time.h:6:
In file included from ./include/linux/seqlock.h:36:
In file included from ./include/linux/spinlock.h:58:
./include/linux/bottom_half.h:19:24: warning: returning address of label,
which is local [-Wreturn-stack-address]
__local_bh_disable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
^~~~~~~~~
./include/linux/kernel.h:204:64: note: expanded from macro '_THIS_IP_'
#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~
In file included from drivers/i2c/algos/i2c-algo-bit.c:21:
In file included from ./include/linux/module.h:10:
In file included from ./include/linux/stat.h:19:
In file included from ./include/linux/time.h:6:
In file included from ./include/linux/seqlock.h:36:
In file included from ./include/linux/spinlock.h:58:
./include/linux/bottom_half.h:32:23: warning: returning address of label,
which is local [-Wreturn-stack-address]
__local_bh_enable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
^~~~~~~~~
./include/linux/kernel.h:204:64: note: expanded from macro '_THIS_IP_'
#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~
In file included from drivers/firmware/efi/memmap.c:10:
In file included from ./include/linux/efi.h:17:
In file included from ./include/linux/time.h:6:
In file included from ./include/linux/seqlock.h:36:
In file included from ./include/linux/spinlock.h:58:
./include/linux/bottom_half.h:19:24: warning: returning address of label,
which is local [-Wreturn-stack-address]
__local_bh_disable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET); CC
kernel/trace/blktrace.o
CC kernel/sched/swait.o

^~~~~~~~~
./include/linux/kernel.h:204:64: note: expanded from macro '_THIS_IP_'
#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~
In file included from drivers/firmware/efi/memmap.c:10:
In file included from ./include/linux/efi.h:17:
In file included from ./include/linux/time.h:6:
In file included from ./include/linux/seqlock.h:36:
In file included from ./include/linux/spinlock.h:58:
./include/linux/bottom_half.h:32:23: warning: returning address of label,
which is local [-Wreturn-stack-address]
__local_bh_enable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
^~~~~~~~~
./include/linux/kernel.h:204:64: note: expanded from macro '_THIS_IP_'
#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~
In file included from CC kernel/pid_namespace.o
2 warnings generated.
net/bridge/netfilter/nf_log_bridge.c:9:
In file included from ./include/linux/module.h:10:
In file included from ./include/linux/stat.h:19:
In file included from ./include/linux/time.h:6:
In file included from ./include/linux/seqlock.h:36:
In file included from ./include/linux/spinlock.h:58:
./include/linux/bottom_half.h:19:24: warning: returning address of label,
which is local [-Wreturn-stack-address]
__local_bh_disable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
^~~~~~~~~
./include/linux/kernel.h:204:64: note: expanded from macro '_THIS_IP_'
#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~
In file included from net/bridge/netfilter/nf_log_bridge.c:9:
In file included from ./include/linux/module.h:10:
In file included from ./include/linux/stat.h:19:
In file included from ./include/linux/time.h:6:
In file included from ./include/linux/seqlock.h:36:
In file included from ./include/linux/spinlock.h:58:
./include/linux/bottom_half.h:32:23: warning: returning address of label,
which is local [-Wreturn-stack-address]
__local_bh_enable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
^~~~~~~~~
./include/linux/kernel.h:204:64: note: expanded from macro '_THIS_IP_'
#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~
2 warnings generated.
2 warnings generated.
2 warnings generated.
In file included from drivers/edac/wq.c:1:
In file included from drivers/edac/edac_module.h:14:
In file included from drivers/edac/edac_mc.h:27:
In file included from ./include/linux/module.h:10:
In file included from ./include/linux/stat.h:19:
In file included from ./include/linux/time.h:6:
In file included from ./include/linux/seqlock.h:36:
In file included from ./include/linux/spinlock.h:58:
./include/linux/bottom_half.h:19:24: warning: returning address of label,
which is local [-Wreturn-stack-address]
__local_bh_disable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
^~~~~~~~~
./include/linux/kernel.h:204:64: note: expanded from macro '_THIS_IP_'
#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~
In file included from drivers/edac/wq.c:1:
In file included from drivers/edac/edac_module.h:14:
In file included from drivers/edac/edac_mc.h:27:
In file included from ./include/linux/module.h:10:
In file included from ./include/linux/stat.h:19:
In file included from ./include/linux/time.h:6:
In file included from ./include/linux/seqlock.h:36:
In file included from ./include/linux/spinlock.h:58:
./include/linux/bottom_half.h:32:23: warning: returning address of label,
which is local [-Wreturn-stack-address]
__local_bh_enable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
^~~~~~~~~
./include/linux/kernel.h:204:64: note: expanded from macro '_THIS_IP_'
#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~
In file included from kernel/trace/trace_nop.c:9:
In file included from ./include/linux/module.h:10:
In file included from ./include/linux/stat.h:19:
In file included from ./include/linux/time.h:6:
In file included from ./include/linux/seqlock.h:36:
In file included from ./include/linux/spinlock.h:58:
./include/linux/bottom_half.h:19:24: warning: returning address of label,
which is local [-Wreturn-stack-address]
__local_bh_disable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
^~~~~~~~~2 warnings generated.

./include/linux/kernel.h:204:64: note: expanded from macro '_THIS_IP_'
#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~
In file included from kernel/trace/trace_nop.c:9:
In file included from ./include/linux/module.h:10:
In file included from ./include/linux/stat.h:19:
In file included from ./include/linux/time.h:6:
In file included from ./include/linux/seqlock.h:36:
In file included from ./include/linux/spinlock.h:58:
./include/linux/bottom_half.h:32:23: warning: returning address of label,
which is local [-Wreturn-stack-address]
__local_bh_enable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
^~~~~~~~~
./include/linux/kernel.h:204:64: note: expanded from macro '_THIS_IP_'
#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~
In file included from kernel/sched/wait_bit.c:4:
In file included from kernel/sched/sched.h:5:
In file included from ./include/linux/sched.h:14:
In file included from ./include/linux/pid.h:5:
In file included from ./include/linux/rculist.h:11:
In file included from ./include/linux/rcupdate.h:41:
./include/linux/bottom_half.h:19:24: warning: returning address of label,
which is local [-Wreturn-stack-address]
_

Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=159d8c81400000


Tested on:

commit: 99e79f6a8963 kmsan: disable assembly implementations of cr..
git tree: https://github.com/google/kmsan.git/master
compiler: clang version 8.0.0 (trunk 339414)
patch: https://syzkaller.appspot.com/x/patch.diff?x=1244639e400000

[Paolo Abeni]

On Mon, 2018-09-17 at 10:02 -0700, syzbot wrote:
> Error text is too large and was truncated, full error text is at:
> https://syzkaller.appspot.com/x/error.txt?x=159d8c81400000

The only error I see in the logs is:

clang-7: error: clang frontend command failed due to signal (use -v to see invocation)

which looks like a build env issue to me ?!? (not related to the code
to be tested).

> Tested on:
>
> commit: 99e79f6a8963 kmsan: disable assembly implementations of cr..
> git tree: https://github.com/google/kmsan.git/master
> compiler: clang version 8.0.0 (trunk 339414)
> patch: https://syzkaller.appspot.com/x/patch.diff?x=1244639e400000

Is there any way to tell syzbot to use a specific (older) version of
clang?

Thanks Paolo

[Alexander Potapenko]

#syz test: https://github.com/google/kmsan.git d2d741e5d189

> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bug...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/bb92fd8366128a9cd42e4692629c3dac2c0b7ae2.camel%40redhat.com.
> For more options, visit https://groups.google.com/d/optout.



--
Alexander Potapenko
Software Engineer

Google Germany GmbH
Erika-Mann-Straße, 33
80636 München

Geschäftsführer: Paul Manicle, Halimah DeLaine Prado
Registergericht und -nummer: Hamburg, HRB 86891
Sitz der Gesellschaft: Hamburg

[syzbot]

Hello,

syzbot tried to test the proposed patch but build/boot failed:

failed to checkout kernel repo https://github.com/google/kmsan.git on
commit d2d741e5d189: failed to run ["git" "checkout" "d2d741e5d189"]: exit
status 1
error: pathspec 'd2d741e5d189' did not match any file(s) known to git.



Tested on:

commit: [unknown]
git tree: https://github.com/google/kmsan.git d2d741e5d189

compiler: clang version 8.0.0 (trunk 339414)

patch: https://syzkaller.appspot.com/x/patch.diff?x=13159721400000

[Alexander Potapenko]

--

[syzbot]

Hello,

syzbot tried to test the proposed patch but build/boot failed:

failed to apply patch:
File net/ipv6/ip6_tunnel.c is read-only; trying to patch anyway
checking file net/ipv6/ip6_tunnel.c
Hunk #1 succeeded at 1223 (offset -11 lines).
patch: **** malformed patch at line 13: net_device *dev)




Tested on:

commit: d2d741e5d189 kmsan: add initialization for shmem pages
git tree: https://github.com/google/kmsan.git

compiler: clang version 8.0.0 (trunk 339414)

patch: https://syzkaller.appspot.com/x/patch.diff?x=13701911400000

[Paolo Abeni]

#syz test: https://github.com/google/kmsan.git d2d741e5d189

It looks like the patch got corrupted in the previous attempt,
let's try again...

[syzbot]

Hello,

syzbot tried to test the proposed patch but build/boot failed:

f.h:19:24: warning: returning address of label, which is local
[-Wreturn-stack-address]
__local_bh_disable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
^~~~~~~~~

./include/linux/kernel.h:170:64: note: expanded from macro '_THIS_IP_'

#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~

In file included from kernel/kprobes.c:34:
In file included from ./include/linux/kprobes.h:35:
In file included from ./include/linux/notifier.h:15:
In file included from ./include/linux/rwsem.h:16:

In file included from ./include/linux/spinlock.h:58:
./include/linux/bottom_half.h:32:23: warning: returning address of label,
which is local [-Wreturn-stack-address]
__local_bh_enable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
^~~~~~~~~

./include/linux/kernel.h:170:64: note: expanded from macro '_THIS_IP_'

#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~

In file included from kernel/kcov.c:11:
In file included from ./include/linux/fs.h:6:
In file included from ./include/linux/wait_bit.h:8:
In file included from ./include/linux/wait.h:9:

In file included from ./include/linux/spinlock.h:58:
./include/linux/bottom_half.h:19:24: warning: returning address of label,
which is local [-Wreturn-stack-address]
__local_bh_disable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
^~~~~~~~~

./include/linux/kernel.h:170:64: note: expanded from macro '_THIS_IP_'

#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~

In file included from kernel/kcov.c:11:
In file included from ./include/linux/fs.h:6:
In file included from ./include/linux/wait_bit.h:8:
In file included from ./include/linux/wait.h:9:

In file included from ./include/linux/spinlock.h:58:
./include/linux/bottom_half.h:32:23: warning: returning address of label,
which is local [-Wreturn-stack-address]
__local_bh_enable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
^~~~~~~~~

./include/linux/kernel.h:170:64: note: expanded from macro '_THIS_IP_'

#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~

2 CC block/partitions/aix.o

warnings generated.
2 warnings generated.

CC mm/workingset.o

2 warnings generated.
2 warnings generated.
2 warnings generated.
2 warnings generated.
2 warnings generated.
2 warnings generated.

In file included from block/partitions/atari.c:12:
In file included from block/partitions/check.h:2:
In file included from ./include/linux/pagemap.h:8:
In file included from ./include/linux/mm.h:10:

In file included from ./include/linux/gfp.h:6:
In file included from ./include/linux/mmzone.h:8:
In file included from ./include/linux/spinlock.h:58:
./include/linux/bottom_half.h:19:24: warning: returning address of label,
which is local [-Wreturn-stack-address]
__local_bh_disable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
^~~~~~~~~

./include/linux/kernel.h:170:64: note: expanded from macro '_THIS_IP_'

#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~

In file included from block/partitions/atari.c:12:
In file included from block/partitions/check.h:2:
In file included from ./include/linux/pagemap.h:8:
In file included from ./include/linux/mm.h:10:

In file included from ./include/linux/gfp.h:6:
In file included from ./include/linux/mmzone.h:8:
In file included from ./include/linux/spinlock.h:58:
./include/linux/bottom_half.h:32:23: warning: returning address of label,
which is local [-Wreturn-stack-address]
__local_bh_enable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
^~~~~~~~~

./include/linux/kernel.h:170:64: note: expanded from macro '_THIS_IP_'

#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~

CC drivers/acpi/acpica/dsutils.o
In file included from mm/list_lru.c:8:

In file included from ./include/linux/module.h:10:
In file included from ./include/linux/stat.h:19:
In file included from ./include/linux/time.h:6:
In file included from ./include/linux/seqlock.h:36:
In file included from ./include/linux/spinlock.h:58:
./include/linux/bottom_half.h:19:24: warning: returning address of label,
which is local [-Wreturn-stack-address]
__local_bh_disable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
^~~~~~~~~

./include/linux/kernel.h:170:64: note: expanded from macro '_THIS_IP_'

#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~

In file included from mm/list_lru.c:8:

In file included from ./include/linux/module.h:10:
In file included from ./include/linux/stat.h:19:
In file included from ./include/linux/time.h:6:
In file included from ./include/linux/seqlock.h:36:
In file included from ./include/linux/spinlock.h:58:
./include/linux/bottom_half.h:32:23: warning: returning address of label,
which is local [-Wreturn-stack-address]
__local_bh_enable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
^~~~~~~~~

./include/linux/kernel.h:170:64: note: expanded from macro '_THIS_IP_'

#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~

CC drivers/md/bcache/debug.o
2 warnings generated.
CC drivers/md/bcache/extents.o
In file included from AR sound/ppc/built-in.o
block/partitions/aix.c:8:
In file included from block/partitions/check.h:2:
In file included from ./include/linux/pagemap.h:8:
In file included from ./include/linux/mm.h:10:

In file included from ./include/linux/gfp.h:6:
In file included from ./include/linux/mmzone.h:8:
In file included from ./include/linux/spinlock.h:58:
./include/linux/bottom_half.h:19:24: warning: returning address of label,
which is local [-Wreturn-stack-address]
__local_bh_disable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
^~~~~~~~~

./include/linux/kernel.h:170:64: note: expanded from macro '_THIS_IP_'

#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~

In file included from block/partitions/aix.c:8:
In file included from block/partitions/check.h:2:
In file included from ./include/linux/pagemap.h:8:
In file included from ./include/linux/mm.h:10:

In file included from ./include/linux/gfp.h:6:
In file included from ./include/linux/mmzone.h:8:
In file included from ./include/linux/spinlock.h:58:
./include/linux/bottom_half.h:32:23: warning: returning address of label,
which is local [-Wreturn-stack-address]
__local_bh_enable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
^~~~~~~~~

./include/linux/kernel.h:170:64: note: expanded from macro '_THIS_IP_'

#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~

CC drivers/acpi/acpica/dswexec.o
CC drivers/md/bcache/io.o
2 warnings generated.
CC crypto/jitterentropy.o
AR sound/sh/built-in.o
2 warnings generated.
In file included from mm/workingset.c:8:
In file included from ./include/linux/memcontrol.h:22:
In file included from ./include/linux/cgroup.h:12:

In file included from ./include/linux/sched.h:14:
In file included from ./include/linux/pid.h:5:
In file included from ./include/linux/rculist.h:11:
In file included from ./include/linux/rcupdate.h:41:
./include/linux/bottom_half.h:19:24: warning: returning address of label,
which is local [-Wreturn-stack-address]
__local_bh_disable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
^~~~~~~~~

./include/linux/kernel.h:170:64: note: expanded from macro '_THIS_IP_'
CC mm/debug.o

#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~

In file included from mm/workingset.c:8:
In file included from ./include/linux/memcontrol.h:22:
In file included from ./include/linux/cgroup.h:12:
In file included from ./include/linux/sched.h:214:

In file included from ./include/linux/pid.h:5:
In file included from ./include/linux/rculist.h:11:
In file included from ./include/linux/rcupdate.h:41:
./include/linux/bottom_half.h:32:23: warning: returning address of label,
which is local [-Wreturn-stack-address]

warnings __local_bh_enable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
^~~~~~~~~
./include/linux/kernel.h generated:170:64: note: expanded from
macro '_THIS_IP_'
.

#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~
2 warnings generated.

AR sound/soc/built-in.o
drivers/infiniband/sw/rxe/rxe.c:105:27: warning: implicit conversion from
enumeration type 'enum rxe_device_param' to different enumeration
type 'enum ib_atomic_cap' [-Wenum-conversion]
rxe->attr.atomic_cap = RXE_ATOMIC_CAP;
~ ^~~~~~~~~~~~~~
drivers/infiniband/sw/rxe/rxe.c:132:22: warning: implicit conversion from
enumeration type 'enum rxe_port_param' to different enumeration type 'enum
ib_port_state' [-Wenum-conversion]
port->attr.state = RXE_PORT_STATE;
~ ^~~~~~~~~~~~~~
drivers/infiniband/sw/rxe/rxe.c:133:24: warning: implicit conversion from
enumeration type 'enum rxe_port_param' to different enumeration type 'enum
ib_mtu' [-Wenum-conversion]
port->attr.max_mtu = RXE_PORT_MAX_MTU;
~ ^~~~~~~~~~~~~~~~
drivers/infiniband/sw/rxe/rxe.c:134:27: warning: implicit conversion from
enumeration type 'enum rxe_port_param' to different enumeration type 'enum
ib_mtu' [-Wenum-conversion]
port->attr.active_mtu = RXE_PORT_ACTIVE_MTU;
~ ^~~~~~~~~~~~~~~~~~~
drivers/infiniband/sw/rxe/rxe.c:152:24: warning: implicit conversion from
enumeration type 'enum rxe_port_param' to different enumeration type 'enum
ib_mtu' [-Wenum-conversion]
ib_mtu_enum_to_int(RXE_PORT_ACTIVE_MTU);
~~~~~~~~~~~~~~~~~~ ^~~~~~~~~~~~~~~~~~~
drivers/infiniband/sw/rxe/rxe.c:304:38: warning: implicit conversion from
enumeration type 'enum rxe_port_param' to different enumeration type 'enum
ib_mtu' [-Wenum-conversion]
mtu = mtu ? min_t(enum ib_mtu, mtu, RXE_PORT_MAX_MTU) : IB_MTU_256;
~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~
./include/linux/kernel.h:875:11: note: expanded from macro 'min_t'
x, y)
^
./include/linux/kernel.h:792:13: note: expanded from macro '__min'
t2 min2 = (y); \
~~~~ ^

2 warnings generated.
2 warnings generated.

CC drivers/gpu/drm/drm_memory.o
2 warnings generated.
In file included from drivers/md/bcache/extents.c:24:
In file included from drivers/md/bcache/bcache.h:182:
In file included from ./include/linux/bio.h:21:
In file included from ./include/linux/highmem.h:5:
In file included from ./include/linux/fs.h:6:
In file included from ./include/linux/wait_bit.h:8:
In file included from ./include/linux/wait.h:9:

In file included from ./include/linux/spinlock.h:58:
./include/linux/bottom_half.h:19:24: warning: returning address of label,
which is local [-Wreturn-stack-address]
__local_bh_disable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
^~~~~~~~~

./include/linux/kernel.h:170:64: note: expanded from macro '_THIS_IP_'

#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~

In file included from drivers/md/bcache/extents.c:24:
In file included from drivers/md/bcache/bcache.h:182:
In file included from ./include/linux/bio.h:21:
In file included from ./include/linux/highmem.h:5:
In file included from ./include/linux/fs.h:6:
In file included from ./include/linux/wait_bit.h:8:
In file included from ./include/linux/wait.h:9:

In file included from ./include/linux/spinlock.h:58:
./include/linux/bottom_half.h:32:23: warning: returning address of label,
which is local [-Wreturn-stack-address]
__local_bh_enable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
^~~~~~~~~

./include/linux/kernel.h:170:64: note: expanded from macro '_THIS_IP_'

#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~
2 warnings generated.
2 warnings generated.

CC block/cfq-iosched.o
AR sound/sparc/built-in.o
In file included from drivers/md/bcache/debug.c:9:
In file included from drivers/md/bcache/bcache.h:182:
In file included from ./include/linux/bio.h:21:
In file included from ./include/linux/highmem.h:5:
In file included from ./include/linux/fs.h:6:
In file included from ./include/linux/wait_bit.h:8:
In file included from ./include/linux/wait.h:9:

In file included from ./include/linux/spinlock.h:58:
./include/linux/bottom_half.h:19:24: warning: returning address of label,
which is local [-Wreturn-stack-address]
__local_bh_disable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
^~~~~~~~~

./include/linux/kernel.h:170:64: note: expanded from macro '_THIS_IP_'

#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~

In file included from drivers/md/bcache/debug.c:9:
In file included from drivers/md/bcache/bcache.h:182:
In file included from ./include/linux/bio.h:21:
In file included from ./include/linux/highmem.h:5:
In file included from ./include/linux/fs.h:6:
In file included from ./include/linux/wait_bit.h:8:
In file included from ./include/linux/wait.h:9:

In file included from ./include/linux/spinlock.h:58:
./include/linux/bottom_half.h:32:23: warning: returning address of label,
which is local [-Wreturn-stack-address]
__local_bh_enable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
^~~~~~~~~

./include/linux/kernel.h:170:64: note: expanded from macro '_THIS_IP_'

#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~

CC kernel/seccomp.o
In file included from drivers/md/bcache/io.c:9:
In file included from drivers/md/bcache/bcache.h:182:
In file included from ./include/linux/bio.h:21:
In file included from ./include/linux/highmem.h:5:
In file included from ./include/linux/fs.h:6:
In file included from ./include/linux/wait_bit.h:8:
In file included from ./include/linux/wait.h:9:

In file included from ./include/linux/spinlock.h:58:

./include/linux/bottom_half.h:19:24: CC drivers/gpu/drm/drm_drv.o
CC drivers/infiniband/ulp/ipoib/ipoib_main.o

warning: returning address of label, which is local [-Wreturn-stack-address]
__local_bh_disable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
^~~~~~~~~

./include/linux/kernel.h:170:64: note: expanded from macro '_THIS_IP_'

#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
^~~~~~~~

In file included from drivers/md/bcache/io.c:9:
In file included from drivers/md/bcache/bcache.h:182:
In file included from ./include/linux/bio.h:21:
In file included from ./include/linux/highmem.h:5:
In file included from ./include/linux/fs.h:6:
In file included from ./include/linux/wait_bit.h:8:
In file included from ./include/linux/wait.h:9:

In file included from ./include/linux/spinlock.h:58:
./include/linux/bottom_half.h:32:23:

Error text is too large and was truncated, full error text is at:

https://syzkaller.appspot.com/x/error.txt?x=15ced6c6400000

Tested on:

commit: d2d741e5d189 kmsan: add initialization for shmem pages
git tree: https://github.com/google/kmsan.git
compiler: clang version 8.0.0 (trunk 339414)

patch: https://syzkaller.appspot.com/x/patch.diff?x=1156da1a400000

[Alexander Potapenko]

On Tue, Sep 18, 2018 at 9:42 AM Paolo Abeni <pab...@redhat.com> wrote:
>

> On Mon, 2018-09-17 at 10:02 -0700, syzbot wrote:
> > Error text is too large and was truncated, full error text is at:
> > https://syzkaller.appspot.com/x/error.txt?x=159d8c81400000
>
> The only error I see in the logs is:
>
> clang-7: error: clang frontend command failed due to signal (use -v to see invocation)
>
> which looks like a build env issue to me ?!? (not related to the code
> to be tested).

Yes, this is indeed a build env issue.
Your patch triggered building KMSAN on the new tree with a fairly old
config (presumably the one used at the time syzkaller first reported
this error).
This led to CONFIG_DRM_AMD_DC_DCN1_0 having been selected (it was
missing in the old config, but maybe other options affected it).
Clang is known to crash on that config because of
https://bugs.llvm.org/show_bug.cgi?id=38738

I've attempted to test your patch on commit d2d741e5d189 (the one at
which the error was reported), but failed, because that commit isn't
on KMSAN master branch, and syzbot was only fetching master.
Dmitry is looking into that.
My other attempt was indeed using a corrupt patch.

In the meantime, I've tested your patch locally, and it fixes the bug.

> > Tested on:
> >
> > commit: 99e79f6a8963 kmsan: disable assembly implementations of cr..
> > git tree: https://github.com/google/kmsan.git/master
> > compiler: clang version 8.0.0 (trunk 339414)
> > patch: https://syzkaller.appspot.com/x/patch.diff?x=1244639e400000
>
> Is there any way to tell syzbot to use a specific (older) version of
> clang?

We've been using a fixed patched Clang revision on syzbot, because
KMSAN compiler instrumentation wasn't upstreamed to LLVM until
recently.
Now it is, so we'll be rolling newer Clang from time to time.

> Thanks Paolo
>
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bug...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/bb92fd8366128a9cd42e4692629c3dac2c0b7ae2.camel%40redhat.com.
> For more options, visit https://groups.google.com/d/optout.

[Paolo Abeni]

On Tue, 2018-09-18 at 15:16 +0200, Alexander Potapenko wrote:
> On Tue, Sep 18, 2018 at 9:42 AM Paolo Abeni <pab...@redhat.com> wrote:
> >
> > On Mon, 2018-09-17 at 10:02 -0700, syzbot wrote:
> > > Error text is too large and was truncated, full error text is at:
> > > https://syzkaller.appspot.com/x/error.txt?x=159d8c81400000
> >
> > The only error I see in the logs is:
> >
> > clang-7: error: clang frontend command failed due to signal (use -v to see invocation)
> >
> > which looks like a build env issue to me ?!? (not related to the code
> > to be tested).
>
> Yes, this is indeed a build env issue.
> Your patch triggered building KMSAN on the new tree with a fairly old
> config (presumably the one used at the time syzkaller first reported
> this error).
> This led to CONFIG_DRM_AMD_DC_DCN1_0 having been selected (it was
> missing in the old config, but maybe other options affected it).
> Clang is known to crash on that config because of
> https://bugs.llvm.org/show_bug.cgi?id=38738
>
> I've attempted to test your patch on commit d2d741e5d189 (the one at
> which the error was reported), but failed, because that commit isn't
> on KMSAN master branch, and syzbot was only fetching master.
> Dmitry is looking into that.

Thank you for all you efforts!

> My other attempt was indeed using a corrupt patch.

Nice ;) I'll try some more local testing before formally submitting it.
Can I eventually add your 'Tested-by:' tag?

> In the meantime, I've tested your patch locally, and it fixes the bug.
>
> > > Tested on:
> > >
> > > commit: 99e79f6a8963 kmsan: disable assembly implementations of cr..
> > > git tree: https://github.com/google/kmsan.git/master
> > > compiler: clang version 8.0.0 (trunk 339414)
> > > patch: https://syzkaller.appspot.com/x/patch.diff?x=1244639e400000
> >
> > Is there any way to tell syzbot to use a specific (older) version of
> > clang?
>
> We've been using a fixed patched Clang revision on syzbot, because
> KMSAN compiler instrumentation wasn't upstreamed to LLVM until
> recently.
> Now it is, so we'll be rolling newer Clang from time to time.

Oks, thanks again for the info.

My owed-beers count is increasing ;)

Cheers,

Paolo

[Alexander Potapenko]

Yes, sure!

> > In the meantime, I've tested your patch locally, and it fixes the bug.
> >
> > > > Tested on:
> > > >
> > > > commit: 99e79f6a8963 kmsan: disable assembly implementations of cr..
> > > > git tree: https://github.com/google/kmsan.git/master
> > > > compiler: clang version 8.0.0 (trunk 339414)
> > > > patch: https://syzkaller.appspot.com/x/patch.diff?x=1244639e400000
> > >
> > > Is there any way to tell syzbot to use a specific (older) version of
> > > clang?
> >
> > We've been using a fixed patched Clang revision on syzbot, because
> > KMSAN compiler instrumentation wasn't upstreamed to LLVM until
> > recently.
> > Now it is, so we'll be rolling newer Clang from time to time.
>
> Oks, thanks again for the info.

Thanks for fixing the bugs!

> My owed-beers count is increasing ;)

> Cheers,
>
> Paolo
>