[syzbot] [kvm?] KMSAN: uninit-value in em_ret_far

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 2cf4f94d8e86 Merge tag 'scsi-fixes' of git://git.kernel.or..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=144e8d01e80000
kernel config: https://syzkaller.appspot.com/x/.config?x=4a65fa9f077ead01
dashboard link: https://syzkaller.appspot.com/bug?extid=579eb95e588b48b4499c
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/589557edbfd5/disk-2cf4f94d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f2480533f00e/vmlinux-2cf4f94d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/9463e8eac2ed/bzImage-2cf4f94d.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+579eb9...@syzkaller.appspotmail.com

=====================================================
BUG: KMSAN: uninit-value in em_ret_far+0x332/0x340 arch/x86/kvm/emulate.c:2258
em_ret_far+0x332/0x340 arch/x86/kvm/emulate.c:2258
x86_emulate_insn+0x1d81/0x5800 arch/x86/kvm/emulate.c:5289
x86_emulate_instruction+0x13c5/0x3090 arch/x86/kvm/x86.c:9101
kvm_mmu_page_fault+0x100a/0x1120 arch/x86/kvm/mmu/mmu.c:5778
handle_ept_violation+0x4ef/0x7e0 arch/x86/kvm/vmx/vmx.c:5788
__vmx_handle_exit arch/x86/kvm/vmx/vmx.c:6567 [inline]
vmx_handle_exit+0x1b01/0x2130 arch/x86/kvm/vmx/vmx.c:6584
vcpu_enter_guest arch/x86/kvm/x86.c:10992 [inline]
vcpu_run arch/x86/kvm/x86.c:11095 [inline]
kvm_arch_vcpu_ioctl_run+0x9d4f/0xc680 arch/x86/kvm/x86.c:11321
kvm_vcpu_ioctl+0xbfc/0x1770 arch/x86/kvm/../../../virt/kvm/kvm_main.c:4155
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl+0x225/0x410 fs/ioctl.c:857
__x64_sys_ioctl+0x96/0xe0 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b

Local variable eip created at:
em_ret_far+0x3a/0x340 arch/x86/kvm/emulate.c:2243
x86_emulate_insn+0x1d81/0x5800 arch/x86/kvm/emulate.c:5289

CPU: 0 PID: 5010 Comm: syz-executor207 Not tainted 6.7.0-rc6-syzkaller-00010-g2cf4f94d8e86 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
=====================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[Nikita Zhandarovich]

#syz test: https://github.com/google/kmsan.git master

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+579eb9...@syzkaller.appspotmail.com

Tested on:

commit: d1d7f15c DO-NOT-SUBMIT: kmsan: add the kmsan_exceed_ma..
git tree: https://github.com/google/kmsan.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=1726e677e80000
kernel config: https://syzkaller.appspot.com/x/.config?x=6b301bd980290807
dashboard link: https://syzkaller.appspot.com/bug?extid=579eb95e588b48b4499c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

Note: no patches were applied.
Note: testing is done by a robot and is best-effort only.

[Aleksandr Nogikh]

I think it's not entirely correct to test it on the kmsan tree as the
kmsan tree is actually quite old (the last commit was 6 months ago),
which is way earlier than the point of time when the bug was detected
(syzbot found it only in Nov 2023 -- 2 months ago).

https://syzkaller.appspot.com/bug?extid=579eb95e588b48b4499c

The bug was last hit today on the head of the torvalds tree:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/?id=9f8413c4a66f2fb776d3dc3c9ed20bf435eb305e

> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bug...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/000000000000fe4ef1060f4f287f%40google.com.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 9f8413c4a66f Merge tag 'cgroup-for-6.8' of git://git.kerne..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=174e24d7e80000
kernel config: https://syzkaller.appspot.com/x/.config?x=656820e61b758b15

dashboard link: https://syzkaller.appspot.com/bug?extid=579eb95e588b48b4499c
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13ffebbde80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=143dcfc7e80000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/79d9f2f4b065/disk-9f8413c4.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/cbc68430d9c6/vmlinux-9f8413c4.xz
kernel image: https://storage.googleapis.com/syzbot-assets/9740ad9fc172/bzImage-9f8413c4.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+579eb9...@syzkaller.appspotmail.com

=====================================================
BUG: KMSAN: uninit-value in em_ret_far+0x332/0x340 arch/x86/kvm/emulate.c:2258
em_ret_far+0x332/0x340 arch/x86/kvm/emulate.c:2258

em_ret_far_imm+0x39/0x4f0 arch/x86/kvm/emulate.c:2270

x86_emulate_insn+0x1d81/0x5800 arch/x86/kvm/emulate.c:5289
x86_emulate_instruction+0x13c5/0x3090 arch/x86/kvm/x86.c:9101
kvm_mmu_page_fault+0x100a/0x1120 arch/x86/kvm/mmu/mmu.c:5778
handle_ept_violation+0x4ef/0x7e0 arch/x86/kvm/vmx/vmx.c:5788
__vmx_handle_exit arch/x86/kvm/vmx/vmx.c:6567 [inline]
vmx_handle_exit+0x1b01/0x2130 arch/x86/kvm/vmx/vmx.c:6584
vcpu_enter_guest arch/x86/kvm/x86.c:10992 [inline]
vcpu_run arch/x86/kvm/x86.c:11095 [inline]
kvm_arch_vcpu_ioctl_run+0x9d4f/0xc680 arch/x86/kvm/x86.c:11321
kvm_vcpu_ioctl+0xbfc/0x1770 arch/x86/kvm/../../../virt/kvm/kvm_main.c:4155
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl+0x225/0x410 fs/ioctl.c:857
__x64_sys_ioctl+0x96/0xe0 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:52 [inline]

do_syscall_64+0x6d/0x140 arch/x86/entry/common.c:83

entry_SYSCALL_64_after_hwframe+0x63/0x6b

Local variable eip created at:
em_ret_far+0x3a/0x340 arch/x86/kvm/emulate.c:2243

em_ret_far_imm+0x39/0x4f0 arch/x86/kvm/emulate.c:2270

CPU: 0 PID: 5001 Comm: syz-executor428 Not tainted 6.7.0-syzkaller-00562-g9f8413c4a66f #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
=====================================================


---

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

[Sean Christopherson]

On Tue, Jan 09, 2024, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 2cf4f94d8e86 Merge tag 'scsi-fixes' of git://git.kernel.or..
> git tree: upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=144e8d01e80000
> kernel config: https://syzkaller.appspot.com/x/.config?x=4a65fa9f077ead01
> dashboard link: https://syzkaller.appspot.com/bug?extid=579eb95e588b48b4499c
> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
>
> Unfortunately, I don't have any reproducer for this issue yet.
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/589557edbfd5/disk-2cf4f94d.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/f2480533f00e/vmlinux-2cf4f94d.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/9463e8eac2ed/bzImage-2cf4f94d.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+579eb9...@syzkaller.appspotmail.com

#syz fix: KVM: x86: Clean up partially uninitialized integer in emulate_pop()