[syzbot] [io-uring?] KMSAN: uninit-value in io_req_task_work_add_remote

18 views
Skip to first unread message

syzbot

unread,
Jul 24, 2024, 6:51:22 AM (3 days ago) Jul 24
to asml.s...@gmail.com, ax...@kernel.dk, io-u...@vger.kernel.org, linux-...@vger.kernel.org, syzkall...@googlegroups.com
Hello,

syzbot found the following issue on:

HEAD commit: 933069701c1b Merge tag '6.11-rc-smb3-server-fixes' of git:..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=16e38d5e980000
kernel config: https://syzkaller.appspot.com/x/.config?x=c062b3d00b275b52
dashboard link: https://syzkaller.appspot.com/bug?extid=82609b8937a4458106ca
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=149e5245980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1388c55e980000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/11dcaf5ed4bb/disk-93306970.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6b2d786e6c09/vmlinux-93306970.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c6cd729a2bbd/bzImage-93306970.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+82609b...@syzkaller.appspotmail.com

=====================================================
BUG: KMSAN: uninit-value in io_req_local_work_add io_uring/io_uring.c:1192 [inline]
BUG: KMSAN: uninit-value in io_req_task_work_add_remote+0x588/0x5d0 io_uring/io_uring.c:1240
io_req_local_work_add io_uring/io_uring.c:1192 [inline]
io_req_task_work_add_remote+0x588/0x5d0 io_uring/io_uring.c:1240
io_msg_remote_post io_uring/msg_ring.c:102 [inline]
io_msg_data_remote io_uring/msg_ring.c:133 [inline]
io_msg_ring_data io_uring/msg_ring.c:152 [inline]
io_msg_ring+0x1c38/0x1ef0 io_uring/msg_ring.c:305
io_issue_sqe+0x383/0x22c0 io_uring/io_uring.c:1710
io_queue_sqe io_uring/io_uring.c:1924 [inline]
io_submit_sqe io_uring/io_uring.c:2180 [inline]
io_submit_sqes+0x1259/0x2f20 io_uring/io_uring.c:2295
__do_sys_io_uring_enter io_uring/io_uring.c:3205 [inline]
__se_sys_io_uring_enter+0x40c/0x3ca0 io_uring/io_uring.c:3142
__x64_sys_io_uring_enter+0x11f/0x1a0 io_uring/io_uring.c:3142
x64_sys_call+0x2d82/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:427
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
__alloc_pages_noprof+0x9d6/0xe70 mm/page_alloc.c:4719
__alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
alloc_slab_page mm/slub.c:2321 [inline]
allocate_slab+0x203/0x1220 mm/slub.c:2484
new_slab mm/slub.c:2537 [inline]
___slab_alloc+0x12ef/0x35e0 mm/slub.c:3723
__kmem_cache_alloc_bulk mm/slub.c:4759 [inline]
kmem_cache_alloc_bulk_noprof+0x486/0x1330 mm/slub.c:4831
__io_alloc_req_refill+0x84/0x560 io_uring/io_uring.c:940
io_alloc_req io_uring/io_uring.h:393 [inline]
io_submit_sqes+0x171b/0x2f20 io_uring/io_uring.c:2284
__do_sys_io_uring_enter io_uring/io_uring.c:3205 [inline]
__se_sys_io_uring_enter+0x40c/0x3ca0 io_uring/io_uring.c:3142
__x64_sys_io_uring_enter+0x11f/0x1a0 io_uring/io_uring.c:3142
x64_sys_call+0x2d82/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:427
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 1 UID: 0 PID: 5053 Comm: syz-executor367 Not tainted 6.10.0-syzkaller-11840-g933069701c1b #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
=====================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Edward Adam Davis

unread,
Jul 24, 2024, 7:13:30 AM (3 days ago) Jul 24
to syzbot+82609b...@syzkaller.appspotmail.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com
when alloc buffer for req, init mem to 0

#syz test: upstream 2c9b3512402e

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 8e6faa942a6f..a650db25c383 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -933,7 +933,7 @@ static void io_preinit_req(struct io_kiocb *req, struct io_ring_ctx *ctx)
__cold bool __io_alloc_req_refill(struct io_ring_ctx *ctx)
__must_hold(&ctx->uring_lock)
{
- gfp_t gfp = GFP_KERNEL | __GFP_NOWARN;
+ gfp_t gfp = GFP_KERNEL | __GFP_NOWARN | __GFP_ZERO;
void *reqs[IO_REQ_ALLOC_BATCH];
int ret;


syzbot

unread,
Jul 24, 2024, 7:39:04 AM (3 days ago) Jul 24
to ead...@qq.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com
Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: uninit-value in io_req_task_work_add_remote

=====================================================
BUG: KMSAN: uninit-value in io_req_local_work_add io_uring/io_uring.c:1192 [inline]
BUG: KMSAN: uninit-value in io_req_task_work_add_remote+0x588/0x5d0 io_uring/io_uring.c:1240
io_req_local_work_add io_uring/io_uring.c:1192 [inline]
io_req_task_work_add_remote+0x588/0x5d0 io_uring/io_uring.c:1240
io_msg_remote_post io_uring/msg_ring.c:102 [inline]
io_msg_data_remote io_uring/msg_ring.c:133 [inline]
io_msg_ring_data io_uring/msg_ring.c:152 [inline]
io_msg_ring+0x1c38/0x1ef0 io_uring/msg_ring.c:305
io_issue_sqe+0x383/0x22c0 io_uring/io_uring.c:1710
io_queue_sqe io_uring/io_uring.c:1924 [inline]
io_submit_sqe io_uring/io_uring.c:2180 [inline]
io_submit_sqes+0x1259/0x2f20 io_uring/io_uring.c:2295
__do_sys_io_uring_enter io_uring/io_uring.c:3205 [inline]
__se_sys_io_uring_enter+0x40c/0x3ca0 io_uring/io_uring.c:3142
__x64_sys_io_uring_enter+0x11f/0x1a0 io_uring/io_uring.c:3142
x64_sys_call+0x2d82/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:427
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
__alloc_pages_noprof+0x9d6/0xe70 mm/page_alloc.c:4706
__alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
alloc_slab_page mm/slub.c:2304 [inline]
allocate_slab+0x20a/0x1550 mm/slub.c:2467
new_slab mm/slub.c:2520 [inline]
___slab_alloc+0x12ef/0x35e0 mm/slub.c:3706
__kmem_cache_alloc_bulk mm/slub.c:4750 [inline]
kmem_cache_alloc_bulk_noprof+0x486/0x1330 mm/slub.c:4822
__io_alloc_req_refill+0x84/0x560 io_uring/io_uring.c:940
io_alloc_req io_uring/io_uring.h:393 [inline]
io_submit_sqes+0x171b/0x2f20 io_uring/io_uring.c:2284
__do_sys_io_uring_enter io_uring/io_uring.c:3205 [inline]
__se_sys_io_uring_enter+0x40c/0x3ca0 io_uring/io_uring.c:3142
__x64_sys_io_uring_enter+0x11f/0x1a0 io_uring/io_uring.c:3142
x64_sys_call+0x2d82/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:427
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 1 PID: 5808 Comm: syz.0.15 Not tainted 6.10.0-syzkaller-11185-g2c9b3512402e-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
=====================================================


Tested on:

commit: 2c9b3512 Merge tag 'for-linus' of git://git.kernel.org..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=11c0f8e3980000
kernel config: https://syzkaller.appspot.com/x/.config?x=6bfb33a8ad10458f
dashboard link: https://syzkaller.appspot.com/bug?extid=82609b8937a4458106ca
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=15e3bca1980000

Edward Adam Davis

unread,
Jul 24, 2024, 8:11:34 AM (3 days ago) Jul 24
to syzbot+82609b...@syzkaller.appspotmail.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com
when alloc buffer for req, init mem to 0

#syz test: upstream 2c9b3512402e

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 8e6faa942a6f..acd2c5aac1ad 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -2177,6 +2177,7 @@ static inline int io_submit_sqe(struct io_ring_ctx *ctx, struct io_kiocb *req,
return 0;
}

+ atomic_set(&ctx->cq_wait_nr, IO_CQ_WAKE_INIT);
io_queue_sqe(req);
return 0;
}

syzbot

unread,
Jul 24, 2024, 11:57:04 AM (3 days ago) Jul 24
to ead...@qq.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com
Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: uninit-value in io_req_task_work_add_remote

=====================================================
BUG: KMSAN: uninit-value in io_req_local_work_add io_uring/io_uring.c:1192 [inline]
BUG: KMSAN: uninit-value in io_req_task_work_add_remote+0x588/0x5d0 io_uring/io_uring.c:1240
io_req_local_work_add io_uring/io_uring.c:1192 [inline]
io_req_task_work_add_remote+0x588/0x5d0 io_uring/io_uring.c:1240
io_msg_remote_post io_uring/msg_ring.c:102 [inline]
io_msg_data_remote io_uring/msg_ring.c:133 [inline]
io_msg_ring_data io_uring/msg_ring.c:152 [inline]
io_msg_ring+0x1c38/0x1ef0 io_uring/msg_ring.c:305
io_issue_sqe+0x383/0x22c0 io_uring/io_uring.c:1710
io_queue_sqe io_uring/io_uring.c:1924 [inline]
io_submit_sqe io_uring/io_uring.c:2181 [inline]
io_submit_sqes+0x1282/0x2f40 io_uring/io_uring.c:2296
__do_sys_io_uring_enter io_uring/io_uring.c:3206 [inline]
__se_sys_io_uring_enter+0x40c/0x3ca0 io_uring/io_uring.c:3143
__x64_sys_io_uring_enter+0x11f/0x1a0 io_uring/io_uring.c:3143
x64_sys_call+0x2d82/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:427
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
__alloc_pages_noprof+0x9d6/0xe70 mm/page_alloc.c:4706
__alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
alloc_slab_page mm/slub.c:2304 [inline]
allocate_slab+0x20a/0x1550 mm/slub.c:2467
new_slab mm/slub.c:2520 [inline]
___slab_alloc+0x12ef/0x35e0 mm/slub.c:3706
__kmem_cache_alloc_bulk mm/slub.c:4750 [inline]
kmem_cache_alloc_bulk_noprof+0x486/0x1330 mm/slub.c:4822
__io_alloc_req_refill+0x84/0x560 io_uring/io_uring.c:940
io_alloc_req io_uring/io_uring.h:393 [inline]
io_submit_sqes+0x1744/0x2f40 io_uring/io_uring.c:2285
__do_sys_io_uring_enter io_uring/io_uring.c:3206 [inline]
__se_sys_io_uring_enter+0x40c/0x3ca0 io_uring/io_uring.c:3143
__x64_sys_io_uring_enter+0x11f/0x1a0 io_uring/io_uring.c:3143
x64_sys_call+0x2d82/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:427
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 0 PID: 5936 Comm: syz.0.15 Not tainted 6.10.0-syzkaller-11185-g2c9b3512402e-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
=====================================================


Tested on:

commit: 2c9b3512 Merge tag 'for-linus' of git://git.kernel.org..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=1286f1f1980000
kernel config: https://syzkaller.appspot.com/x/.config?x=6bfb33a8ad10458f
dashboard link: https://syzkaller.appspot.com/bug?extid=82609b8937a4458106ca
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=1302d5ad980000

Jens Axboe

unread,
Jul 24, 2024, 12:04:52 PM (3 days ago) Jul 24
to syzbot, asml.s...@gmail.com, io-u...@vger.kernel.org, linux-...@vger.kernel.org, syzkall...@googlegroups.com
On 7/24/24 4:51 AM, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 933069701c1b Merge tag '6.11-rc-smb3-server-fixes' of git:..
> git tree: upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=16e38d5e980000
> kernel config: https://syzkaller.appspot.com/x/.config?x=c062b3d00b275b52
> dashboard link: https://syzkaller.appspot.com/bug?extid=82609b8937a4458106ca
> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=149e5245980000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1388c55e980000


diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 2626424f5d73..1aaab21e1574 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -1137,9 +1137,10 @@ static inline void io_req_local_work_add(struct io_kiocb *req,
BUILD_BUG_ON(IO_CQ_WAKE_FORCE <= IORING_MAX_CQ_ENTRIES);

/*
- * We don't know how many reuqests is there in the link and whether
- * they can even be queued lazily, fall back to non-lazy.
+ * We don't know how many requests are in the link and whether they can
+ * even be queued lazily, fall back to non-lazy.
*/
+ req->nr_tw = 0;
if (req->flags & (REQ_F_LINK | REQ_F_HARDLINK))
flags &= ~IOU_F_TWQ_LAZY_WAKE;


--
Jens Axboe

Jens Axboe

unread,
Jul 24, 2024, 2:37:21 PM (3 days ago) Jul 24
to syzbot, asml.s...@gmail.com, io-u...@vger.kernel.org, linux-...@vger.kernel.org, syzkall...@googlegroups.com
On 7/24/24 4:51 AM, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 933069701c1b Merge tag '6.11-rc-smb3-server-fixes' of git:..
> git tree: upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=16e38d5e980000
> kernel config: https://syzkaller.appspot.com/x/.config?x=c062b3d00b275b52
> dashboard link: https://syzkaller.appspot.com/bug?extid=82609b8937a4458106ca
> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=149e5245980000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1388c55e980000

#syz test

syzbot

unread,
Jul 24, 2024, 2:59:05 PM (3 days ago) Jul 24
to asml.s...@gmail.com, ax...@kernel.dk, io-u...@vger.kernel.org, linux-...@vger.kernel.org, syzkall...@googlegroups.com
Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: uninit-value in io_req_task_work_add_remote

=====================================================
BUG: KMSAN: uninit-value in io_req_local_work_add io_uring/io_uring.c:1193 [inline]
BUG: KMSAN: uninit-value in io_req_task_work_add_remote+0x592/0x5e0 io_uring/io_uring.c:1241
io_req_local_work_add io_uring/io_uring.c:1193 [inline]
io_req_task_work_add_remote+0x592/0x5e0 io_uring/io_uring.c:1241
io_msg_remote_post io_uring/msg_ring.c:102 [inline]
io_msg_data_remote io_uring/msg_ring.c:133 [inline]
io_msg_ring_data io_uring/msg_ring.c:152 [inline]
io_msg_ring+0x1c38/0x1ef0 io_uring/msg_ring.c:305
io_issue_sqe+0x383/0x22c0 io_uring/io_uring.c:1711
io_queue_sqe io_uring/io_uring.c:1925 [inline]
io_submit_sqe io_uring/io_uring.c:2181 [inline]
io_submit_sqes+0x1259/0x2f20 io_uring/io_uring.c:2296
__do_sys_io_uring_enter io_uring/io_uring.c:3206 [inline]
__se_sys_io_uring_enter+0x40c/0x3ca0 io_uring/io_uring.c:3143
__x64_sys_io_uring_enter+0x11f/0x1a0 io_uring/io_uring.c:3143
x64_sys_call+0x2d82/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:427
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
__alloc_pages_noprof+0x9d6/0xe70 mm/page_alloc.c:4719
__alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
alloc_slab_page mm/slub.c:2321 [inline]
allocate_slab+0x203/0x1220 mm/slub.c:2484
new_slab mm/slub.c:2537 [inline]
___slab_alloc+0x12ef/0x35e0 mm/slub.c:3723
__kmem_cache_alloc_bulk mm/slub.c:4759 [inline]
kmem_cache_alloc_bulk_noprof+0x486/0x1330 mm/slub.c:4831
__io_alloc_req_refill+0x84/0x560 io_uring/io_uring.c:940
io_alloc_req io_uring/io_uring.h:393 [inline]
io_submit_sqes+0x171b/0x2f20 io_uring/io_uring.c:2285
__do_sys_io_uring_enter io_uring/io_uring.c:3206 [inline]
__se_sys_io_uring_enter+0x40c/0x3ca0 io_uring/io_uring.c:3143
__x64_sys_io_uring_enter+0x11f/0x1a0 io_uring/io_uring.c:3143
x64_sys_call+0x2d82/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:427
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 0 UID: 0 PID: 5924 Comm: syz.0.16 Not tainted 6.10.0-syzkaller-12268-g7a3fad30fd8b-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
=====================================================


Tested on:

commit: 7a3fad30 Merge tag 'random-6.11-rc1-for-linus' of git:..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13a6fa19980000
kernel config: https://syzkaller.appspot.com/x/.config?x=f26f43c6f7db5ad2
dashboard link: https://syzkaller.appspot.com/bug?extid=82609b8937a4458106ca
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=178ca779980000

Jens Axboe

unread,
Jul 24, 2024, 4:34:53 PM (3 days ago) Jul 24
to syzbot, asml.s...@gmail.com, io-u...@vger.kernel.org, linux-...@vger.kernel.org, syzkall...@googlegroups.com
#syz test

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 8e6faa942a6f..198bbbfe465c 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -1164,8 +1164,10 @@ static inline void io_req_local_work_add(struct io_kiocb *req,
* previous adds should've tried to wake the task.
*/
nr_tw = nr_tw_prev + 1;
+#if 0
if (!(flags & IOU_F_TWQ_LAZY_WAKE))
nr_tw = IO_CQ_WAKE_FORCE;
+#endif

req->nr_tw = nr_tw;
req->io_task_work.node.next = head;
--
Jens Axboe

syzbot

unread,
Jul 24, 2024, 5:03:04 PM (3 days ago) Jul 24
to asml.s...@gmail.com, ax...@kernel.dk, io-u...@vger.kernel.org, linux-...@vger.kernel.org, syzkall...@googlegroups.com
Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+82609b...@syzkaller.appspotmail.com
Tested-by: syzbot+82609b...@syzkaller.appspotmail.com

Tested on:

commit: c33ffdb7 Merge tag 'phy-for-6.11' of git://git.kernel...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17d29bb5980000
kernel config: https://syzkaller.appspot.com/x/.config?x=f26f43c6f7db5ad2
dashboard link: https://syzkaller.appspot.com/bug?extid=82609b8937a4458106ca
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=120b7dad980000

Note: testing is done by a robot and is best-effort only.

Jens Axboe

unread,
Jul 24, 2024, 5:04:49 PM (3 days ago) Jul 24
to syzbot, asml.s...@gmail.com, io-u...@vger.kernel.org, linux-...@vger.kernel.org, syzkall...@googlegroups.com
As I figured... No idea what's going on here, nr_tw is what is being
complained about and it's _clearly_ initialized. Randomly disabling a
branch that won't touch it off this path (hence it should be a no-op in
terms of code executed messing with nr_tw) makes it go away.

--
Jens Axboe

Jens Axboe

unread,
Jul 25, 2024, 10:46:38 AM (2 days ago) Jul 25
to syzbot, asml.s...@gmail.com, io-u...@vger.kernel.org, linux-...@vger.kernel.org, syzkall...@googlegroups.com
On 7/24/24 3:03 PM, syzbot wrote:
#syz test: git://git.kernel.dk/linux io_uring-6.11

--
Jens Axboe


syzbot

unread,
Jul 25, 2024, 1:32:05 PM (2 days ago) Jul 25
to asml.s...@gmail.com, ax...@kernel.dk, io-u...@vger.kernel.org, linux-...@vger.kernel.org, syzkall...@googlegroups.com
Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+82609b...@syzkaller.appspotmail.com
Tested-by: syzbot+82609b...@syzkaller.appspotmail.com

Tested on:

commit: 0db4618e io_uring/msg_ring: fix uninitialized use of t..
git tree: git://git.kernel.dk/linux io_uring-6.11
console output: https://syzkaller.appspot.com/x/log.txt?x=11879ae3980000
kernel config: https://syzkaller.appspot.com/x/.config?x=f80e9475fcd20eb6
dashboard link: https://syzkaller.appspot.com/bug?extid=82609b8937a4458106ca
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

Note: no patches were applied.
Reply all
Reply to author
Forward
0 new messages