[syzbot] KMSAN: uninit-value in idmouse_open

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: ce8056d1f79e wip: changed copy_from_user where instrumented
git tree: https://github.com/google/kmsan.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=16a02941900000
kernel config: https://syzkaller.appspot.com/x/.config?x=3afe005fb99591f
dashboard link: https://syzkaller.appspot.com/bug?extid=79832d33eb89fb3cd092
compiler: clang version 10.0.0 (https://github.com/llvm/llvm-project/ c2443155a0fb245c8f17f2c1c72b6ea391e86e81)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=165e850e900000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=123a8c96900000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+79832d...@syzkaller.appspotmail.com

=====================================================
BUG: KMSAN: uninit-value in idmouse_create_image drivers/usb/misc/idmouse.c:187 [inline]
BUG: KMSAN: uninit-value in idmouse_open+0x12da/0x1780 drivers/usb/misc/idmouse.c:249
CPU: 0 PID: 8474 Comm: syz-executor157 Not tainted 5.8.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x21c/0x280 lib/dump_stack.c:118
kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:121
__msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215
idmouse_create_image drivers/usb/misc/idmouse.c:187 [inline]
idmouse_open+0x12da/0x1780 drivers/usb/misc/idmouse.c:249
usb_open+0x27f/0x400 drivers/usb/core/file.c:48
chrdev_open+0xc7c/0xe10 fs/char_dev.c:414
do_dentry_open+0x12bc/0x1d30 fs/open.c:828
vfs_open+0xaf/0xe0 fs/open.c:942
do_open fs/namei.c:3243 [inline]
path_openat+0x542b/0x6ba0 fs/namei.c:3360
do_filp_open+0x2b8/0x710 fs/namei.c:3387
do_sys_openat2+0xa6a/0x1020 fs/open.c:1179
do_sys_open fs/open.c:1195 [inline]
ksys_open include/linux/syscalls.h:1388 [inline]
__do_sys_open fs/open.c:1201 [inline]
__se_sys_open+0x270/0x2d0 fs/open.c:1199
__x64_sys_open+0x4a/0x70 fs/open.c:1199
do_syscall_64+0xad/0x160 arch/x86/entry/common.c:386
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x401470
Code: Bad RIP value.
RSP: 002b:00007ffe8619e918 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 0000000000401470
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00007ffe8619e930
RBP: 00000000006cf018 R08: 0000000000000000 R09: 000000000000000f
R10: 0000000000000064 R11: 0000000000000246 R12: 00000000004023d0
R13: 0000000000402460 R14: 0000000000000000 R15: 0000000000000000

Uninit was created at:
kmsan_save_stack_with_flags+0x3c/0x90 mm/kmsan/kmsan.c:144
kmsan_internal_alloc_meta_for_pages mm/kmsan/kmsan_shadow.c:269 [inline]
kmsan_alloc_page+0xc5/0x1a0 mm/kmsan/kmsan_shadow.c:293
__alloc_pages_nodemask+0xdf0/0x1030 mm/page_alloc.c:4889
alloc_pages_current+0x685/0xb50 mm/mempolicy.c:2292
alloc_pages include/linux/gfp.h:545 [inline]
kmalloc_order mm/slab_common.c:1325 [inline]
kmalloc_order_trace+0x92/0x3d0 mm/slab_common.c:1341
kmalloc_large include/linux/slab.h:484 [inline]
kmalloc include/linux/slab.h:548 [inline]
idmouse_probe+0x48c/0xa60 drivers/usb/misc/idmouse.c:352
usb_probe_interface+0xece/0x1550 drivers/usb/core/driver.c:374
really_probe+0xf20/0x20b0 drivers/base/dd.c:529
driver_probe_device+0x293/0x390 drivers/base/dd.c:701
__device_attach_driver+0x63f/0x830 drivers/base/dd.c:807
bus_for_each_drv+0x2ca/0x3f0 drivers/base/bus.c:431
__device_attach+0x4e2/0x7f0 drivers/base/dd.c:873
device_initial_probe+0x4a/0x60 drivers/base/dd.c:920
bus_probe_device+0x177/0x3d0 drivers/base/bus.c:491
device_add+0x3b0e/0x40d0 drivers/base/core.c:2680
usb_set_configuration+0x380f/0x3f10 drivers/usb/core/message.c:2032
usb_generic_driver_probe+0x138/0x300 drivers/usb/core/generic.c:241
usb_probe_device+0x311/0x490 drivers/usb/core/driver.c:272
really_probe+0xf20/0x20b0 drivers/base/dd.c:529
driver_probe_device+0x293/0x390 drivers/base/dd.c:701
__device_attach_driver+0x63f/0x830 drivers/base/dd.c:807
bus_for_each_drv+0x2ca/0x3f0 drivers/base/bus.c:431
__device_attach+0x4e2/0x7f0 drivers/base/dd.c:873
device_initial_probe+0x4a/0x60 drivers/base/dd.c:920
bus_probe_device+0x177/0x3d0 drivers/base/bus.c:491
device_add+0x3b0e/0x40d0 drivers/base/core.c:2680
usb_new_device+0x1bd4/0x2a30 drivers/usb/core/hub.c:2554
hub_port_connect drivers/usb/core/hub.c:5208 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5348 [inline]
port_event drivers/usb/core/hub.c:5494 [inline]
hub_event+0x5e7b/0x8a70 drivers/usb/core/hub.c:5576
process_one_work+0x1688/0x2140 kernel/workqueue.c:2269
worker_thread+0x10bc/0x2730 kernel/workqueue.c:2415
kthread+0x551/0x590 kernel/kthread.c:292
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293
=====================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

[Oliver Neukum]

On 19.09.22 10:21, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: ce8056d1f79e wip: changed copy_from_user where instrumented
> git tree: https://github.com/google/kmsan.git master
> console output: https://syzkaller.appspot.com/x/log.txt?x=16a02941900000
> kernel config: https://syzkaller.appspot.com/x/.config?x=3afe005fb99591f
> dashboard link: https://syzkaller.appspot.com/bug?extid=79832d33eb89fb3cd092
> compiler: clang version 10.0.0 (https://github.com/llvm/llvm-project/ c2443155a0fb245c8f17f2c1c72b6ea391e86e81)
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=165e850e900000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=123a8c96900000
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+79832d...@syzkaller.appspotmail.com

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/greg/usb.git
ce8056d1f79e

[Oliver Neukum]

On 19.09.22 10:21, syzbot wrote:

> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: ce8056d1f79e wip: changed copy_from_user where instrumented
> git tree: https://github.com/google/kmsan.git master
> console output: https://syzkaller.appspot.com/x/log.txt?x=16a02941900000
> kernel config: https://syzkaller.appspot.com/x/.config?x=3afe005fb99591f
> dashboard link: https://syzkaller.appspot.com/bug?extid=79832d33eb89fb3cd092
> compiler: clang version 10.0.0 (https://github.com/llvm/llvm-project/ c2443155a0fb245c8f17f2c1c72b6ea391e86e81)
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=165e850e900000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=123a8c96900000
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+79832d...@syzkaller.appspotmail.com

#syz test https://github.com/google/kmsan.git ce8056d1f79e

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to checkout kernel repo https://github.com/google/kmsan.git on commit ce8056d1f79e: failed to run ["git" "checkout" "ce8056d1f79e"]: exit status 1
error: pathspec 'ce8056d1f79e' did not match any file(s) known to git



Tested on:

commit: [unknown
git tree: https://github.com/google/kmsan.git ce8056d1f79e

dashboard link: https://syzkaller.appspot.com/bug?extid=79832d33eb89fb3cd092
compiler:

patch: https://syzkaller.appspot.com/x/patch.diff?x=121d662f080000

[Alexander Potapenko]

Hi Oliver,

Please use "#syz test https://github.com/google/kmsan.git master" instead.
KMSAN still lives in a downstream tree, it doesn't contain your commits yet.

[Oliver Neukum]

On 19.09.22 10:21, syzbot wrote:

> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: ce8056d1f79e wip: changed copy_from_user where instrumented
> git tree: https://github.com/google/kmsan.git master
> console output: https://syzkaller.appspot.com/x/log.txt?x=16a02941900000
> kernel config: https://syzkaller.appspot.com/x/.config?x=3afe005fb99591f
> dashboard link: https://syzkaller.appspot.com/bug?extid=79832d33eb89fb3cd092
> compiler: clang version 10.0.0 (https://github.com/llvm/llvm-project/ c2443155a0fb245c8f17f2c1c72b6ea391e86e81)
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=165e850e900000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=123a8c96900000
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+79832d...@syzkaller.appspotmail.com

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

le included from ./include/linux/cpumask.h:12:
In file included from ./include/linux/bitmap.h:11:
In file included from ./include/linux/string.h:253:
./include/linux/fortify-string.h:387:9: warning: 'memcpy' macro redefined [-Wmacro-redefined]
#define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \
^
./arch/x86/include/asm/string_64.h:17:9: note: previous definition is here
#define memcpy __msan_memcpy
^
In file included from drivers/input/gameport/gameport.c:13:
In file included from ./include/linux/module.h:13:
In file included from ./include/linux/stat.h:19:
In file included from ./include/linux/time.h:60:
In file included from ./include/linux/time32.h:13:
In file included from ./include/linux/timex.h:67:
In file included from ./arch/x86/include/asm/timex.h:5:
In file included from ./arch/x86/include/asm/processor.h:22:
In file included from ./arch/x86/include/asm/msr.h:11:
In file included from ./arch/x86/include/asm/cpumask.h:5:
In file included from ./include/linux/cpumask.h:12:
In file included from ./include/linux/bitmap.h:11:
In file included from ./include/linux/string.h:253:
./include/linux/fortify-string.h:391:9: warning: 'memmove' macro redefined [-Wmacro-redefined]
#define memmove(p, q, s) __fortify_memcpy_chk(p, q, s, \
^
./arch/x86/include/asm/string_64.h:73:9: note: previous definition is here
#define memmove __msan_memmove
^
2 warnings generated.
CC net/netlabel/netlabel_calipso.o
CC net/ipv4/fib_rules.o
In file included from drivers/firewire/core-transaction.c:9:
In file included from ./include/linux/completion.h:12:
In file included from ./include/linux/swait.h:7:
In file included from ./include/linux/spinlock.h:55:
In file included from ./include/linux/preempt.h:78:
In file included from ./arch/x86/include/asm/preempt.h:7:
In file included from ./include/linux/thread_info.h:60:
In file included from ./arch/x86/include/asm/thread_info.h:53:
In file included from ./arch/x86/include/asm/cpufeature.h:5:
In file included from ./arch/x86/include/asm/processor.h:22:
In file included from ./arch/x86/include/asm/msr.h:11:
In file included from ./arch/x86/include/asm/cpumask.h:5:
In file included from ./include/linux/cpumask.h:12:
In file included from ./include/linux/bitmap.h:11:
In file included from ./include/linux/string.h:253:
./include/linux/fortify-string.h:387:9: warning: 'memcpy' macro redefined [-Wmacro-redefined]
#define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \
^
./arch/x86/include/asm/string_64.h:17:9: note: previous definition is here
#define memcpy __msan_memcpy
^
In file included from drivers/firewire/core-transaction.c:9:
In file included from ./include/linux/completion.h:12:
In file included from ./include/linux/swait.h:7:
In file included from ./include/linux/spinlock.h:55:
In file included from ./include/linux/preempt.h:78:
In file included from ./arch/x86/include/asm/preempt.h:7:
In file included from ./include/linux/thread_info.h:60:
In file included from ./arch/x86/include/asm/thread_info.h:53:
In file included from ./arch/x86/include/asm/cpufeature.h:5:
In file included from ./arch/x86/include/asm/processor.h:22:
In file included from ./arch/x86/include/asm/msr.h:11:
In file included from ./arch/x86/include/asm/cpumask.h:5:
In file included from ./include/linux/cpumask.h:12:
In file included from ./include/linux/bitmap.h:11:
In file included from ./include/linux/string.h:253:
./include/linux/fortify-string.h:391:9: warning: 'memmove' macro redefined [-Wmacro-redefined]
#define memmove(p, q, s) __fortify_memcpy_chk(p, q, s, \
^
./arch/x86/include/asm/string_64.h:73:9: note: previous definition is here
#define memmove __msan_memmove
^
CC net/rds/send.o
In file included from net/netlabel/netlabel_calipso.c:18:
In file included from ./include/linux/socket.h:8:
In file included from ./include/linux/uio.h:9:
In file included from ./include/linux/thread_info.h:60:
In file included from ./arch/x86/include/asm/thread_info.h:53:
In file included from ./arch/x86/include/asm/cpufeature.h:5:
In file included from ./arch/x86/include/asm/processor.h:22:
In file included from ./arch/x86/include/asm/msr.h:11:
In file included from ./arch/x86/include/asm/cpumask.h:5:
In file included from ./include/linux/cpumask.h:12:
In file included from CC drivers/block/aoe/aoecmd.o
./include/linux/bitmap.h:11:
In file included from ./include/linux/string.h:253:
./include/linux/fortify-string.h:387:9: warning: 'memcpy' macro redefined [-Wmacro-redefined]
#define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \
^
./arch/x86/include/asm/string_64.h:17:9: note: previous definition is here
#define memcpy __msan_memcpy
^
In file included from net/netlabel/netlabel_calipso.c:18:
In file included from ./include/linux/socket.h:8:
In file included from ./include/linux/uio.h:9:
In file included from ./include/linux/thread_info.h:60:
In file included from ./arch/x86/include/asm/thread_info.h:53:
In file included from ./arch/x86/include/asm/cpufeature.h:5:
In file included from ./arch/x86/include/asm/processor.h:22:
In file included from ./arch/x86/include/asm/msr.h:11:
In file included from ./arch/x86/include/asm/cpumask.h:5:
In file included from ./include/linux/cpumask.h:12:
In file included from ./include/linux/bitmap.h:11:
In file included from ./include/linux/string.h:253:
./include/linux/fortify-string.h:391:9: warning: 'memmove' macro redefined [-Wmacro-redefined]
#define memmove(p, q, s) __fortify_memcpy_chk(p, q, s, \
^
./arch/x86/include/asm/string_64.h:73:9: note: previous definition is here
#define memmove __msan_memmove
^
In file included from drivers/block/aoe/aoecmd.c:7:
In file included from ./include/linux/ata.h:17:
In file included from ./include/linux/string.h:253:
./include/linux/fortify-string.h:387:9: warning: 'memcpy' macro redefined [-Wmacro-redefined]
#define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \
^
./arch/x86/include/asm/string_64.h:17:9: note: previous definition is here
#define memcpy __msan_memcpy
^
In file included from drivers/block/aoe/aoecmd.c:7:
In file included from ./include/linux/ata.h:17:
In file included from ./include/linux/string.h:253:
./include/linux/fortify-string.h:391:9: warning: 'memmove' macro redefined [-Wmacro-redefined]
#define memmove(p, q, s) __fortify_memcpy_chk(p, q, s, \
^
./arch/x86/include/asm/string_64.h:73:9: note: previous definition is here
#define memmove __msan_memmove
^
2 warnings generated.
In file included from net/rds/send.c:35:
In file included from ./include/linux/gfp.h:7:
In file included from ./include/linux/mmzone.h:8:
In file included from ./include/linux/spinlock.h:55:
In file included from ./include/linux/preempt.h:78:
In file included from ./arch/x86/include/asm/preempt.h:7:
In file included from ./include/linux/thread_info.h:60:
In file included from ./arch/x86/include/asm/thread_info.h:53:
In file included from ./arch/x86/include/asm/cpufeature.h:5:
In file included from ./arch/x86/include/asm/processor.h:22:
In file included from ./arch/x86/include/asm/msr.h:11:
In file included from ./arch/x86/include/asm/cpumask.h:5:
In file included from ./include/linux/cpumask.h:12:
In file included from ./include/linux/bitmap.h:11:
In file included from ./include/linux/string.h:253:
./include/linux/fortify-string.h:387:9: warning: 'memcpy' macro redefined [-Wmacro-redefined]
#define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \
^
./arch/x86/include/asm/string_64.h:17:9: note: previous definition is here
#define memcpy __msan_memcpy
^
In file included from net/rds/send.c:35:
In file included from ./include/linux/gfp.h:7:
In file included from ./include/linux/mmzone.h:8:
In file included from ./include/linux/spinlock.h:55:
In file included from ./include/linux/preempt.h:78:
In file included from ./arch/x86/include/asm/preempt.h:7:
In file included from ./include/linux/thread_info.h:60:
In file included from ./arch/x86/include/asm/thread_info.h:53:
In file included from ./arch/x86/include/asm/cpufeature.h:5:
In file included from ./arch/x86/include/asm/processor.h:22:
In file included from ./arch/x86/include/asm/msr.h:11:
In file included from ./arch/x86/include/asm/cpumask.h:5:
In file included from ./include/linux/cpumask.h:12:
In file included from ./include/linux/bitmap.h:11:
In file included from ./include/linux/string.h:253:
./include/linux/fortify-string.h:391:9: warning: 'memmove' macro redefined [-Wmacro-redefined]
#define memmove(p, q, s) __fortify_memcpy_chk(p, q, s, \
^
./arch/x86/include/asm/string_64.h:73:9: note: previous definition is here
#define memmove __msan_memmove
^
In file included from net/ipv4/fib_rules.c:19:
In file included from ./include/linux/netdevice.h:24:
In file included from ./include/linux/timer.h:6:
In file included from ./include/linux/ktime.h:24:
In file included from ./include/linux/time.h:60:
In file included from ./include/linux/time32.h:13:
In file included from ./include/linux/timex.h:67:
In file included from ./arch/x86/include/asm/timex.h:5:
In file included from ./arch/x86/include/asm/processor.h:22:
In file included from ./arch/x86/include/asm/msr.h:11:
In file included from ./arch/x86/include/asm/cpumask.h:5:
In file included from ./include/linux/cpumask.h:12:
In file included from ./include/linux/bitmap.h:11:
In file included from ./include/linux/string.h:253:
./include/linux/fortify-string.h:387:9: warning: 'memcpy' macro redefined [-Wmacro-redefined]
#define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \
^
./arch/x86/include/asm/string_64.h:17:9: note: previous definition is here
#define memcpy __msan_memcpy
^
In file included from net/ipv4/fib_rules.c:19:
In file included from ./include/linux/netdevice.h:24:
In file included from ./include/linux/timer.h:6:
In file included from ./include/linux/ktime.h:24:
In file included from ./include/linux/time.h:60:
In file included from ./include/linux/time32.h:13:
In file included from ./include/linux/timex.h:67:
In file included from ./arch/x86/include/asm/timex.h:5:
In file included from ./arch/x86/include/asm/processor.h:22:
In file included from ./arch/x86/include/asm/msr.h:11:
In file included from ./arch/x86/include/asm/cpumask.h:5:
In file included from ./include/linux/cpumask.h:12:
In file included from ./include/linux/bitmap.h:11:
In file included from ./include/linux/string.h:253:
./include/linux/fortify-string.h:391:9: warning: 'memmove' macro redefined [-Wmacro-redefined]
#define memmove(p, q, s) __fortify_memcpy_chk(p, q, s, \
^
./arch/x86/include/asm/string_64.h:73:9: note: previous definition is here
#define memmove __msan_memmove
^
2 warnings generated.
2 warnings generated.
2 warnings generated.
In file included from net/wireless/scan.c:11:
In file included from ./include/linux/slab.h:15:
In file included from ./include/linux/gfp.h:7:
In file included from ./include/linux/mmzone.h:8:
In file included from ./include/linux/spinlock.h:55:
In file included from ./include/linux/preempt.h:78:
In file included from ./arch/x86/include/asm/preempt.h:7:
In file included from ./include/linux/thread_info.h:60:
In file included from ./arch/x86/include/asm/thread_info.h:53:
In file included from ./arch/x86/include/asm/cpufeature.h:5:
In file included from ./arch/x86/include/asm/processor.h:22:
In file included from ./arch/x86/include/asm/msr.h:11:
In file included from ./arch/x86/include/asm/cpumask.h:5:
In file included from ./include/linux/cpumask.h:12:
In file included from ./include/linux/bitmap.h:11:
In file included from ./include/linux/string.h:253:
./include/linux/fortify-string.h:387:9: warning: 'memcpy' macro redefined [-Wmacro-redefined]
#define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \
^
./arch/x86/include/asm/string_64.h:17:9: note: previous definition is here
#define memcpy __msan_memcpy
^
In file included from net/wireless/scan.c:11:
In file included from ./include/linux/slab.h:15:
In file included from ./include/linux/gfp.h:7:
In file included from ./include/linux/mmzone.h:8:
In file included from ./include/linux/spinlock.h:55:
In file included from ./include/linux/preempt.h:78:
In file included from ./arch/x86/include/asm/preempt.h:7:
In file included from ./include/linux/thread_info.h:60:
In file included from ./arch/x86/include/asm/thread_info.h:53:
In file included from ./arch/x86/include/asm/cpufeature.h:5:
In file included from ./arch/x86/include/asm/processor.h:22:
In file included from ./arch/x86/include/asm/msr.h:11:
In file included from ./arch/x86/include/asm/cpumask.h:5:
In file included from ./include/linux/cpumask.h:12:
In file included from ./include/linux/bitmap.h:11:
In file included from ./include/linux/string.h:253:
./include/linux/fortify-string.h:391:9: warning: 'memmove' macro redefined [-Wmacro-redefined]
#define memmove(p, q, s) __fortify_memcpy_chk(p, q, s, \
^
./arch/x86/include/asm/string_64.h:73:9: note: previous definition is here
#define memmove __msan_memmove
^
22 warnings generated.
warnings generated.
2 warnings generated.
CC drivers/usb/common/debug.o
CC fs/gfs2/meta_io.o
2 warnings generated.
2 warnings generated.
2 warnings generated.
2 warnings generated.
CC drivers/block/aoe/aoedev.o
2 warnings generated.
2 warnings generated.
CC drivers/target/target_core_tmr.o
In file included from net/rds/recv.c:34:
In file included from ./include/linux/slab.h:15:
In file included from ./include/linux/gfp.h:7:
In file included from ./include/linux/mmzone.h:8:
In file included from ./include/linux/spinlock.h:55:
In file included from ./include/linux/preempt.h:78:
In file included from ./arch/x86/include/asm/preempt.h:7:
In file included from ./include/linux/thread_info.h:60:
In file included from ./arch/x86/include/asm/thread_info.h:53:
In file included from ./arch/x86/include/asm/cpufeature.h:5:
In file included from ./arch/x86/include/asm/processor.h:22:
In file included from ./arch/x86/include/asm/msr.h:11:
In file included from ./arch/x86/include/asm/cpumask.h:5:
In file included from ./include/linux/cpumask.h:12:
In file included from ./include/linux/bitmap.h:11:
In file included from ./include/linux/string.h:253:
./include/linux/fortify-string.h:387:9: warning: 'memcpy' macro redefined [-Wmacro-redefined]
#define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \
^
./arch/x86/include/asm/string_64.h:17:9: note: previous definition is here
#define memcpy __msan_memcpy
^
In file included from net/rds/recv.c:34:
In file included from ./include/linux/slab.h:15:
In file included from ./include/linux/gfp.h:7:
In file included from ./include/linux/mmzone.h:8:
In file included from ./include/linux/spinlock.h:55:
In file included from ./include/linux/preempt.h:78:
In file included from ./arch/x86/include/asm/preempt.h:7:
In file included from ./include/linux/thread_info.h:60:
In file included from ./arch/x86/include/asm/thread_info.h:53:
In file included from ./arch/x86/include/asm/cpufeature.h:5:
In file included from ./arch/x86/include/asm/processor.h:22:
In file included from ./arch/x86/include/asm/msr.h:11:
In file included from ./arch/x86/include/asm/cpumask.h:5:
In file included from ./include/linux/cpumask.h:12:
In file included from ./include/linux/bitmap.h:11:
In file included from ./include/linux/string.h:253:
./include/linux/fortify-string.h:391:9: warning: 'memmove' macro redefined [-Wmacro-redefined]
#define memmove(p, q, s) __fortify_memcpy_chk(p, q, s, \
^
./arch/x86/include/asm/string_64.h:73:9: note: previous definition is here
#define memmove __msan_memmove
^
CC fs/gfs2/aops.o
CC net/dccp/ackvec.o
CC fs/gfs2/dentry.o
In file included from drivers/usb/common/common.c:12:
In file included from ./include/linux/module.h:13:
In file included from ./include/linux/stat.h:19:
In file included from ./include/linux/time.h:60:
In file included from ./include/linux/time32.h:13:
In file included from ./include/linux/timex.h:67:
In file included from ./arch/

Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=133848f4880000


Tested on:

commit: 968c2729 x86: kmsan: fix comment in kmsan_shadow.c

git tree: https://github.com/google/kmsan.git master

dashboard link: https://syzkaller.appspot.com/bug?extid=79832d33eb89fb3cd092
compiler: clang version 15.0.0 (https://github.com/llvm/llvm-project.git 610139d2d9ce6746b3c617fb3e2f7886272d26ff), GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=12a57360880000

[syzbot]

git tree: https://github.com/google/kmsan.git master

dashboard link: https://syzkaller.appspot.com/bug?extid=79832d33eb89fb3cd092

[Alexander Potapenko]

#syz test: https://github.com/google/kmsan.git master

--
Alexander Potapenko
Software Engineer

Google Germany GmbH
Erika-Mann-Straße, 33
80636 München

Geschäftsführer: Paul Manicle, Liana Sebastian
Registergericht und -nummer: Hamburg, HRB 86891
Sitz der Gesellschaft: Hamburg

[Oliver Neukum]

On 19.09.22 10:21, syzbot wrote:

> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: ce8056d1f79e wip: changed copy_from_user where instrumented
> git tree: https://github.com/google/kmsan.git master
> console output: https://syzkaller.appspot.com/x/log.txt?x=16a02941900000
> kernel config: https://syzkaller.appspot.com/x/.config?x=3afe005fb99591f
> dashboard link: https://syzkaller.appspot.com/bug?extid=79832d33eb89fb3cd092
> compiler: clang version 10.0.0 (https://github.com/llvm/llvm-project/ c2443155a0fb245c8f17f2c1c72b6ea391e86e81)
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=165e850e900000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=123a8c96900000
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+79832d...@syzkaller.appspotmail.com

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

In file included from ./include/linux/module.harch/x86/kernel/module.c:230:49: error: call to undeclared library function 'memcpy' with type 'void *(void *, const void *, unsigned long)'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]

Tested on:

commit: 968c2729 x86: kmsan: fix comment in kmsan_shadow.c

git tree: https://github.com/google/kmsan.git master

dashboard link: https://syzkaller.appspot.com/bug?extid=79832d33eb89fb3cd092

compiler: clang version 15.0.0 (https://github.com/llvm/llvm-project.git 610139d2d9ce6746b3c617fb3e2f7886272d26ff), GNU ld (GNU Binutils for Debian) 2.35.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=17f0b59c880000

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

arch/x86/kernel/module.c:230:49: error: call to undeclared library function 'memcpy' with type 'void *(void *, const void *, unsigned long)'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]


Tested on:

commit: 968c2729 x86: kmsan: fix comment in kmsan_shadow.c

git tree: https://github.com/google/kmsan.git master

dashboard link: https://syzkaller.appspot.com/bug?extid=79832d33eb89fb3cd092

compiler: clang version 15.0.0 (https://github.com/llvm/llvm-project.git 610139d2d9ce6746b3c617fb3e2f7886272d26ff), GNU ld (GNU Binutils for Debian) 2.35.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=10f3519c880000