[syzbot] [bcachefs?] KMSAN: uninit-value in bch2_checksum_update (2)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: f92f4749861b Merge tag 'clk-fixes-for-linus' of git://git...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=129b3544580000
kernel config: https://syzkaller.appspot.com/x/.config?x=95d0bb0535bcaca0
dashboard link: https://syzkaller.appspot.com/bug?extid=60ea31958b52b09e04af
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/71d71ad0e41a/disk-f92f4749.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3c061489bceb/vmlinux-f92f4749.xz
kernel image: https://storage.googleapis.com/syzbot-assets/30c84208490c/bzImage-f92f4749.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+60ea31...@syzkaller.appspotmail.com

bcachefs (loop9): shutting down
bcachefs (loop9): going read-only
bcachefs (loop9): finished waiting for writes to stop
bcachefs (loop9): flushing journal and stopping allocators, journal seq 11
=====================================================
BUG: KMSAN: uninit-value in crc64_be+0x202/0x310 lib/crc64.c:59
crc64_be+0x202/0x310 lib/crc64.c:59
bch2_checksum_update+0x15e/0x1d0 fs/bcachefs/checksum.c:88
bch2_checksum+0x3ca/0x800 fs/bcachefs/checksum.c:225
__bch2_btree_node_write+0x52e3/0x6830 fs/bcachefs/btree_io.c:2148
bch2_btree_node_write+0xa5/0x2e0 fs/bcachefs/btree_io.c:2284
btree_node_write_if_need fs/bcachefs/btree_io.h:151 [inline]
__btree_node_flush+0x606/0x680 fs/bcachefs/btree_trans_commit.c:252
bch2_btree_node_flush1+0x38/0x60 fs/bcachefs/btree_trans_commit.c:266
journal_flush_pins+0xce6/0x1780 fs/bcachefs/journal_reclaim.c:565
journal_flush_done+0x156/0x3f0 fs/bcachefs/journal_reclaim.c:822
bch2_journal_flush_pins+0xdb/0x3b0 fs/bcachefs/journal_reclaim.c:852
bch2_journal_flush_all_pins fs/bcachefs/journal_reclaim.h:76 [inline]
__bch2_fs_read_only+0x210/0xb40 fs/bcachefs/super.c:276
bch2_fs_read_only+0xd2c/0x15d0 fs/bcachefs/super.c:356
__bch2_fs_stop+0xf0/0xf10 fs/bcachefs/super.c:621
bch2_put_super+0x3c/0x50 fs/bcachefs/fs.c:2050
generic_shutdown_super+0x197/0x4c0 fs/super.c:642
bch2_kill_sb+0x3d/0x70 fs/bcachefs/fs.c:2278
deactivate_locked_super+0xe0/0x3f0 fs/super.c:473
deactivate_super+0x14f/0x160 fs/super.c:506
cleanup_mnt+0x6bb/0x730 fs/namespace.c:1373
__cleanup_mnt+0x22/0x30 fs/namespace.c:1380
task_work_run+0x268/0x310 kernel/task_work.c:239
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0xbf/0x160 kernel/entry/common.c:218
do_syscall_64+0xda/0x1e0 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
memcpy_u64s_small fs/bcachefs/util.h:393 [inline]
bkey_p_copy fs/bcachefs/bkey.h:47 [inline]
bch2_sort_keys_keep_unwritten_whiteouts+0x12d5/0x19d0 fs/bcachefs/bkey_sort.c:187
__bch2_btree_node_write+0x3ae8/0x6830 fs/bcachefs/btree_io.c:2095
bch2_btree_node_write+0xa5/0x2e0 fs/bcachefs/btree_io.c:2284
btree_node_write_if_need fs/bcachefs/btree_io.h:151 [inline]
__btree_node_flush+0x606/0x680 fs/bcachefs/btree_trans_commit.c:252
bch2_btree_node_flush1+0x38/0x60 fs/bcachefs/btree_trans_commit.c:266
journal_flush_pins+0xce6/0x1780 fs/bcachefs/journal_reclaim.c:565
journal_flush_done+0x156/0x3f0 fs/bcachefs/journal_reclaim.c:822
bch2_journal_flush_pins+0xdb/0x3b0 fs/bcachefs/journal_reclaim.c:852
bch2_journal_flush_all_pins fs/bcachefs/journal_reclaim.h:76 [inline]
__bch2_fs_read_only+0x210/0xb40 fs/bcachefs/super.c:276
bch2_fs_read_only+0xd2c/0x15d0 fs/bcachefs/super.c:356
__bch2_fs_stop+0xf0/0xf10 fs/bcachefs/super.c:621
bch2_put_super+0x3c/0x50 fs/bcachefs/fs.c:2050
generic_shutdown_super+0x197/0x4c0 fs/super.c:642
bch2_kill_sb+0x3d/0x70 fs/bcachefs/fs.c:2278
deactivate_locked_super+0xe0/0x3f0 fs/super.c:473
deactivate_super+0x14f/0x160 fs/super.c:506
cleanup_mnt+0x6bb/0x730 fs/namespace.c:1373
__cleanup_mnt+0x22/0x30 fs/namespace.c:1380
task_work_run+0x268/0x310 kernel/task_work.c:239
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0xbf/0x160 kernel/entry/common.c:218
do_syscall_64+0xda/0x1e0 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
___kmalloc_large_node+0x22c/0x370 mm/slub.c:4238
__kmalloc_large_node_noprof+0x3f/0x1e0 mm/slub.c:4255
__do_kmalloc_node mm/slub.c:4271 [inline]
__kmalloc_node_noprof+0xc96/0x1250 mm/slub.c:4289
__kvmalloc_node_noprof+0xc0/0x2d0 mm/util.c:650
btree_bounce_alloc fs/bcachefs/btree_io.c:124 [inline]
btree_node_sort+0x78a/0x1d30 fs/bcachefs/btree_io.c:323
bch2_btree_post_write_cleanup+0x1b0/0xf20 fs/bcachefs/btree_io.c:2248
bch2_btree_node_write+0x21c/0x2e0 fs/bcachefs/btree_io.c:2289
btree_node_write_if_need fs/bcachefs/btree_io.h:151 [inline]
__btree_node_flush+0x606/0x680 fs/bcachefs/btree_trans_commit.c:252
bch2_btree_node_flush0+0x35/0x60 fs/bcachefs/btree_trans_commit.c:261
journal_flush_pins+0xce6/0x1780 fs/bcachefs/journal_reclaim.c:565
__bch2_journal_reclaim+0xda8/0x1670 fs/bcachefs/journal_reclaim.c:698
bch2_journal_reclaim_thread+0x18e/0x760 fs/bcachefs/journal_reclaim.c:740
kthread+0x3e2/0x540 kernel/kthread.c:389
ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

CPU: 0 UID: 0 PID: 13300 Comm: syz-executor Tainted: G W 6.13.0-rc2-syzkaller-00031-gf92f4749861b #0
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
=====================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 00a7d39898c8 fs/pipe: add simpler helpers for common cases
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1334c878580000
kernel config: https://syzkaller.appspot.com/x/.config?x=523d3ff8e053340a

dashboard link: https://syzkaller.appspot.com/bug?extid=60ea31958b52b09e04af
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13c56a54580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1158e4b7980000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e8b5895e19ac/disk-00a7d398.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/4ba923545cbc/vmlinux-00a7d398.xz
kernel image: https://storage.googleapis.com/syzbot-assets/820c28b7d351/bzImage-00a7d398.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/f69b61b5c375/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+60ea31...@syzkaller.appspotmail.com

bcachefs (loop0): dropping and reconstructing all alloc info
==================================================================
BUG: KASAN: use-after-free in crc64_be+0x131/0x1f0 lib/crc64.c:58
Read of size 1 at addr ffff888072e00000 by task syz-executor238/5820

CPU: 1 UID: 0 PID: 5820 Comm: syz-executor238 Not tainted 6.14.0-rc5-syzkaller-00137-g00a7d39898c8 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:408 [inline]
print_report+0x16e/0x5b0 mm/kasan/report.c:521
kasan_report+0x143/0x180 mm/kasan/report.c:634
crc64_be+0x131/0x1f0 lib/crc64.c:58
bch2_checksum_update+0x10f/0x160 fs/bcachefs/checksum.c:89
bch2_checksum+0x37e/0x780 fs/bcachefs/checksum.c:226
bch2_btree_node_read_done+0x155c/0x6180 fs/bcachefs/btree_io.c:1100
btree_node_read_work+0x6dc/0x1380 fs/bcachefs/btree_io.c:1358
bch2_btree_node_read+0x2433/0x29f0
__bch2_btree_root_read fs/bcachefs/btree_io.c:1789 [inline]
bch2_btree_root_read+0x626/0x7b0 fs/bcachefs/btree_io.c:1811
read_btree_roots+0x3d3/0xa70 fs/bcachefs/recovery.c:581
bch2_fs_recovery+0x260f/0x3de0 fs/bcachefs/recovery.c:928
bch2_fs_start+0x37c/0x610 fs/bcachefs/super.c:1041
bch2_fs_get_tree+0xdb7/0x17a0 fs/bcachefs/fs.c:2203
vfs_get_tree+0x90/0x2b0 fs/super.c:1814
do_new_mount+0x2be/0xb40 fs/namespace.c:3560
do_mount fs/namespace.c:3900 [inline]
__do_sys_mount fs/namespace.c:4111 [inline]
__se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4088
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8317bc351a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffec09d9368 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffec09d9380 RCX: 00007f8317bc351a
RDX: 00004000000000c0 RSI: 0000400000000000 RDI: 00007ffec09d9380
RBP: 0000400000000000 R08: 00007ffec09d93c0 R09: 0000000000005950
R10: 000000000100000a R11: 0000000000000282 R12: 00004000000000c0
R13: 00007ffec09d93c0 R14: 0000000000000003 R15: 000000000100000a
</TASK>

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x72e00
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 ffffea0001cb8108 ffffea0001dfa708 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xcc0(GFP_KERNEL), pid 1, tgid 1 (swapper/0), ts 15177598220, free_ts 16347346247
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f4/0x240 mm/page_alloc.c:1551
split_free_pages+0xe1/0x2d0 mm/page_alloc.c:6355
alloc_contig_range_noprof+0x10eb/0x1770 mm/page_alloc.c:6532
__alloc_contig_pages mm/page_alloc.c:6562 [inline]
alloc_contig_pages_noprof+0x4b3/0x5c0 mm/page_alloc.c:6644
debug_vm_pgtable_alloc_huge_page+0xaf/0x100 mm/debug_vm_pgtable.c:1084
init_args+0x83b/0xb20 mm/debug_vm_pgtable.c:1266
debug_vm_pgtable+0xe4/0x590 mm/debug_vm_pgtable.c:1304
do_one_initcall+0x248/0x930 init/main.c:1257
do_initcall_level+0x157/0x210 init/main.c:1319
do_initcalls+0x71/0xd0 init/main.c:1335
kernel_init_freeable+0x435/0x5d0 init/main.c:1568
kernel_init+0x1d/0x2b0 init/main.c:1457
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
page last free pid 1 tgid 1 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1127 [inline]
free_frozen_pages+0xe04/0x10e0 mm/page_alloc.c:2660
free_contig_range+0x14c/0x430 mm/page_alloc.c:6678
destroy_args+0x94/0x4b0 mm/debug_vm_pgtable.c:1017
debug_vm_pgtable+0x551/0x590 mm/debug_vm_pgtable.c:1397
do_one_initcall+0x248/0x930 init/main.c:1257
do_initcall_level+0x157/0x210 init/main.c:1319
do_initcalls+0x71/0xd0 init/main.c:1335
kernel_init_freeable+0x435/0x5d0 init/main.c:1568
kernel_init+0x1d/0x2b0 init/main.c:1457
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Memory state around the buggy address:
ffff888072dfff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888072dfff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888072e00000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888072e00080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888072e00100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

[syzbot]

syzbot has bisected this issue to:

commit 03ef80b469d5d83530ce1ce15be78a40e5300f9b
Author: Kent Overstreet <kent.ov...@linux.dev>
Date: Sat Sep 23 22:41:51 2023 +0000

bcachefs: Ignore unknown mount options

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=14ec14b7980000
start commit: 00a7d39898c8 fs/pipe: add simpler helpers for common cases
git tree: upstream
final oops: https://syzkaller.appspot.com/x/report.txt?x=16ec14b7980000
console output: https://syzkaller.appspot.com/x/log.txt?x=12ec14b7980000

kernel config: https://syzkaller.appspot.com/x/.config?x=523d3ff8e053340a
dashboard link: https://syzkaller.appspot.com/bug?extid=60ea31958b52b09e04af

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13c56a54580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1158e4b7980000

Reported-by: syzbot+60ea31...@syzkaller.appspotmail.com
Fixes: 03ef80b469d5 ("bcachefs: Ignore unknown mount options")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.

***

Subject:
Author: kent.ov...@linux.dev

#syz fix bcachefs: Disable asm memcpys when kmsan enabled