Hello,
syzbot found the following issue on:
HEAD commit: 71b1543c83d6 Merge tag '6.9-rc5-ksmbd-fixes' of git://git...
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=1784bdd7180000
kernel config: https://syzkaller.appspot.com/x/.config?x=776c05250f36d55c
dashboard link: https://syzkaller.appspot.com/bug?extid=5681e40d297b30f5b513
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15b440d3180000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14b00907180000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/14813ccfbcb3/disk-71b1543c.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e7b88b42cf07/vmlinux-71b1543c.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3a64a5abfbba/bzImage-71b1543c.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: [email protected]
=====================================================
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
BUG: KMSAN: kernel-infoleak in copy_to_user_iter lib/iov_iter.c:24 [inline]
BUG: KMSAN: kernel-infoleak in iterate_ubuf include/linux/iov_iter.h:29 [inline]
BUG: KMSAN: kernel-infoleak in iterate_and_advance2 include/linux/iov_iter.h:245 [inline]
BUG: KMSAN: kernel-infoleak in iterate_and_advance include/linux/iov_iter.h:271 [inline]
BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x366/0x2520 lib/iov_iter.c:185
instrument_copy_to_user include/linux/instrumented.h:114 [inline]
copy_to_user_iter lib/iov_iter.c:24 [inline]
iterate_ubuf include/linux/iov_iter.h:29 [inline]
iterate_and_advance2 include/linux/iov_iter.h:245 [inline]
iterate_and_advance include/linux/iov_iter.h:271 [inline]
_copy_to_iter+0x366/0x2520 lib/iov_iter.c:185
copy_to_iter include/linux/uio.h:196 [inline]
memcpy_to_msg include/linux/skbuff.h:4113 [inline]
raw_recvmsg+0x2b8/0x9e0 net/can/raw.c:1008
sock_recvmsg_nosec net/socket.c:1046 [inline]
sock_recvmsg+0x2c4/0x340 net/socket.c:1068
____sys_recvmsg+0x18a/0x620 net/socket.c:2803
___sys_recvmsg+0x223/0x840 net/socket.c:2845
do_recvmmsg+0x4fc/0xfd0 net/socket.c:2939
__sys_recvmmsg net/socket.c:3018 [inline]
__do_sys_recvmmsg net/socket.c:3041 [inline]
__se_sys_recvmmsg net/socket.c:3034 [inline]
__x64_sys_recvmmsg+0x397/0x490 net/socket.c:3034
x64_sys_call+0xf6c/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:300
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was created at:
slab_post_alloc_hook mm/slub.c:3804 [inline]
slab_alloc_node mm/slub.c:3845 [inline]
kmem_cache_alloc_node+0x613/0xc50 mm/slub.c:3888
kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577
__alloc_skb+0x35b/0x7a0 net/core/skbuff.c:668
alloc_skb include/linux/skbuff.h:1313 [inline]
alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6504
sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2795
sock_alloc_send_skb include/net/sock.h:1842 [inline]
j1939_sk_alloc_skb net/can/j1939/socket.c:878 [inline]
j1939_sk_send_loop net/can/j1939/socket.c:1142 [inline]
j1939_sk_sendmsg+0xc0a/0x2730 net/can/j1939/socket.c:1277
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0x30f/0x380 net/socket.c:745
____sys_sendmsg+0x877/0xb60 net/socket.c:2584
___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638
__sys_sendmsg net/socket.c:2667 [inline]
__do_sys_sendmsg net/socket.c:2676 [inline]
__se_sys_sendmsg net/socket.c:2674 [inline]
__x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2674
x64_sys_call+0xc4b/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:47
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Bytes 12-15 of 16 are uninitialized
Memory access of size 16 starts at ffff888120969690
Data copied to user address 00000000200017c0
CPU: 1 PID: 5050 Comm: syz-executor198 Not tainted 6.9.0-rc5-syzkaller-00031-g71b1543c83d6 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
=====================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at [email protected].
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
Hello Oleksij,
can this probably be caused by a missing initialization of unused data
in j1939_sk_alloc_skb()?
Best regards,
Oliver
On 26.04.24 13:04, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 71b1543c83d6 Merge tag '6.9-rc5-ksmbd-fixes' of git://git...
> git tree: upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=1784bdd7180000
> kernel config: https://syzkaller.appspot.com/x/.config?x=776c05250f36d55c
> dashboard link: https://syzkaller.appspot.com/bug?extid=5681e40d297b30f5b513
> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15b440d3180000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14b00907180000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/14813ccfbcb3/disk-71b1543c.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/e7b88b42cf07/vmlinux-71b1543c.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/3a64a5abfbba/bzImage-71b1543c.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: [email protected]
>
> =====================================================
> BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
> BUG: KMSAN: kernel-infoleak in copy_to_user_iter lib/iov_iter.c:24 [inline]
> BUG: KMSAN: kernel-infoleak in iterate_ubuf include/linux/iov_iter.h:29 [inline]
> BUG: KMSAN: kernel-infoleak in iterate_and_advance2 include/linux/iov_iter.h:245 [inline]
> BUG: KMSAN: kernel-infoleak in iterate_and_advance include/linux/iov_iter.h:271 [inline]
> BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x366/0x2520 lib/iov_iter.c:185
> instrument_copy_to_user include/linux/instrumented.h:114 [inline]
> copy_to_user_iter lib/iov_iter.c:24 [inline]
> iterate_ubuf include/linux/iov_iter.h:29 [inline]
> iterate_and_advance2 include/linux/iov_iter.h:245 [inline]
> iterate_and_advance include/linux/iov_iter.h:271 [inline]
> _copy_to_iter+0x366/0x2520 lib/iov_iter.c:185
> copy_to_iter include/linux/uio.h:196 [inline]
> memcpy_to_msg include/linux/skbuff.h:4113 [inline]
> raw_recvmsg+0x2b8/0x9e0 net/can/raw.c:1008
> sock_recvmsg_nosec net/socket.c:1046 [inline]
> sock_recvmsg+0x2c4/0x340 net/socket.c:1068
> ____sys_recvmsg+0x18a/0x620 net/socket.c:2803
> ___sys_recvmsg+0x223/0x840 net/socket.c:2845
> do_recvmmsg+0x4fc/0xfd0 net/socket.c:2939
> __sys_recvmmsg net/socket.c:3018 [inline]
> __do_sys_recvmmsg net/socket.c:3041 [inline]
> __se_sys_recvmmsg net/socket.c:3034 [inline]
> __x64_sys_recvmmsg+0x397/0x490 net/socket.c:3034
> x64_sys_call+0xf6c/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:300
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> Uninit was created at:
> slab_post_alloc_hook mm/slub.c:3804 [inline]
> slab_alloc_node mm/slub.c:3845 [inline]
> kmem_cache_alloc_node+0x613/0xc50 mm/slub.c:3888
> kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577
> __alloc_skb+0x35b/0x7a0 net/core/skbuff.c:668
> alloc_skb include/linux/skbuff.h:1313 [inline]
> alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6504
> sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2795
> sock_alloc_send_skb include/net/sock.h:1842 [inline]
> j1939_sk_alloc_skb net/can/j1939/socket.c:878 [inline]
> j1939_sk_send_loop net/can/j1939/socket.c:1142 [inline]
> j1939_sk_sendmsg+0xc0a/0x2730 net/can/j1939/socket.c:1277
> sock_sendmsg_nosec net/socket.c:730 [inline]
> __sock_sendmsg+0x30f/0x380 net/socket.c:745
> ____sys_sendmsg+0x877/0xb60 net/socket.c:2584
> ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638
> __sys_sendmsg net/socket.c:2667 [inline]
> __do_sys_sendmsg net/socket.c:2676 [inline]
> __se_sys_sendmsg net/socket.c:2674 [inline]
> __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2674
> x64_sys_call+0xc4b/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:47
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> Bytes 12-15 of 16 are uninitialized
> Memory access of size 16 starts at ffff888120969690
> Data copied to user address 00000000200017c0
>
> CPU: 1 PID: 5050 Comm: syz-executor198 Not tainted 6.9.0-rc5-syzkaller-00031-g71b1543c83d6 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
> =====================================================
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at [email protected].
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
>
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
>
> If you want to overwrite report's subsystems, reply with:
> #syz set subsystems: new-subsystem
> (See the list of subsystem names on the web dashboard)
>
> If the report is a duplicate of another one, reply with:
> #syz dup: exact-subject-of-another-report
>
> If you want to undo deduplication, reply with:
> #syz undup
>
For archival purposes, forwarding an incoming command email to
[email protected].
***
Subject: Test for 5681e40d297b30f5b513
Author: [email protected]
#syz test
diff --git a/net/can/j1939/main.c b/net/can/j1939/main.c
index a6fb89fa6278..df01628c6509 100644
--- a/net/can/j1939/main.c
+++ b/net/can/j1939/main.c
@@ -344,6 +344,9 @@ int j1939_send_one(struct j1939_priv *priv, struct sk_buff *skb)
/* make it a full can frame again */
skb_put(skb, J1939_CAN_FTR + (8 - dlc));
+ /* initialize unused data */
+ memset(cf->data + dlc, 0, 8 - dlc);
+
canid = CAN_EFF_FLAG |
(skcb->priority << 26) |
(skcb->addr.pgn << 8) |
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: [email protected]
Tested on:
commit: cf87f46f Merge tag 'drm-fixes-2024-05-11' of https://g..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15a15c20980000
kernel config: https://syzkaller.appspot.com/x/.config?x=617171361dd3cd47
dashboard link: https://syzkaller.appspot.com/bug?extid=5681e40d297b30f5b513
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=16e15cd0980000
Note: testing is done by a robot and is best-effort only.
For archival purposes, forwarding an incoming command email to
[email protected].
***
Subject: Test for 5681e40d297b30f5b513
Author: [email protected]
#syz test
diff --git a/net/can/j1939/main.c b/net/can/j1939/main.c
index a6fb89fa6278..7e8a20f2fc42 100644
--- a/net/can/j1939/main.c
+++ b/net/can/j1939/main.c
@@ -30,10 +30,6 @@ MODULE_ALIAS("can-proto-" __stringify(CAN_J1939));
/* CAN_HDR: #bytes before can_frame data part */
#define J1939_CAN_HDR (offsetof(struct can_frame, data))
-/* CAN_FTR: #bytes beyond data part */
-#define J1939_CAN_FTR (sizeof(struct can_frame) - J1939_CAN_HDR - \
- sizeof(((struct can_frame *)0)->data))
-
/* lowest layer */
static void j1939_can_recv(struct sk_buff *iskb, void *data)
{
@@ -342,7 +338,7 @@ int j1939_send_one(struct j1939_priv *priv, struct sk_buff *skb)
memset(cf, 0, J1939_CAN_HDR);
/* make it a full can frame again */
- skb_put(skb, J1939_CAN_FTR + (8 - dlc));
+ skb_put_zero(skb, 8 - dlc);
canid = CAN_EFF_FLAG |
(skcb->priority << 26) |
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
ima: No TPM chip found, activating TPM-bypass!
[ 50.039109][ T1] Loading compiled-in module X.509 certificates
[ 50.083961][ T1] Loaded X.509 cert 'Build time autogenerated kernel key: ed37ac0c9a8f55c6ba8aa91286c3f4ce83e3fe2b'
[ 50.095135][ T1] ima: Allocated hash algorithm: sha256
[ 50.101198][ T1] ima: No architecture policies found
[ 50.107754][ T1] evm: Initialising EVM extended attributes:
[ 50.113851][ T1] evm: security.selinux (disabled)
[ 50.119108][ T1] evm: security.SMACK64 (disabled)
[ 50.124324][ T1] evm: security.SMACK64EXEC (disabled)
[ 50.129959][ T1] evm: security.SMACK64TRANSMUTE (disabled)
[ 50.135991][ T1] evm: security.SMACK64MMAP (disabled)
[ 50.141763][ T1] evm: security.apparmor
[ 50.146091][ T1] evm: security.ima
[ 50.150083][ T1] evm: security.capability
[ 50.154796][ T1] evm: HMAC attrs: 0x1
[ 50.164184][ T1] PM: Magic number: 8:300:83
[ 50.169166][ T1] sound pcmC1D1p: hash matches
[ 50.176711][ T1] platform QEMU0001:00: hash matches
[ 50.182388][ T1] acpi QEMU0001:00: hash matches
[ 50.187948][ T1] printk: legacy console [netcon0] enabled
[ 50.193949][ T1] netconsole: network logging started
[ 50.200795][ T1] gtp: GTP module loaded (pdp ctx size 128 bytes)
[ 50.209727][ T1] rdma_rxe: loaded
[ 50.215570][ T1] cfg80211: Loading compiled-in X.509 certificates for regulatory database
[ 50.236664][ T1] Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
[ 50.254692][ T1] Loaded X.509 cert 'wens: 61c038651aabdcf94bd0ac7ff06c7248db18c600'
[ 50.263177][ T1] clk: Disabling unused clocks
[ 50.268190][ T1] ALSA device list:
[ 50.272172][ T1] #0: Dummy 1
[ 50.275724][ T1] #1: Loopback 1
[ 50.279796][ T1] #2: Virtual MIDI Card 1
[ 50.290001][ T43] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2
[ 50.300031][ T43] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db
[ 50.309651][ T1] md: Waiting for all devices to be available before autodetect
[ 50.317651][ T1] md: If you don't use raid, use raid=noautodetect
[ 50.324371][ T1] md: Autodetecting RAID arrays.
[ 50.329451][ T1] md: autorun ...
[ 50.333934][ T1] md: ... autorun DONE.
[ 50.472668][ T1] EXT4-fs (sda1): mounted filesystem 5941fea2-f5fa-4b4e-b5ef-9af118b27b95 ro with ordered data mode. Quota mode: none.
[ 50.485882][ T1] VFS: Mounted root (ext4 filesystem) readonly on device 8:1.
[ 50.518764][ T1] devtmpfs: mounted
[ 50.799320][ T1] Freeing unused kernel image (initmem) memory: 37072K
[ 50.811563][ T1] Write protecting the kernel read-only data: 262144k
[ 50.859067][ T1] Freeing unused kernel image (rodata/data gap) memory: 1828K
[ 52.516123][ T1] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[ 52.526352][ T1] x86/mm: Checking user space page tables
[ 54.031927][ T1] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[ 54.040796][ T1] Failed to set sysctl parameter 'kernel.hung_task_all_cpu_backtrace=1': parameter not found
[ 54.061983][ T1] Failed to set sysctl parameter 'max_rcu_stall_to_panic=1': parameter not found
[ 54.074907][ T1] Run /sbin/init as init process
[ 55.706656][ T4458] mount (4458) used greatest stack depth: 7936 bytes left
[ 55.796948][ T4459] EXT4-fs (sda1): re-mounted 5941fea2-f5fa-4b4e-b5ef-9af118b27b95 r/w. Quota mode: none.
mount: mounting smackfs on /sys/fs/smackfs failed: No such file or directory
mount: mounting selinuxfs on /sys/fs/selinux failed: No such file or directory
[ 56.135964][ T4462] mount (4462) used greatest stack depth: 5536 bytes left
Starting syslogd: OK
Starting acpid: OK
Starting klogd: OK
Running sysctl: OK
Populating /dev using udev: [ 60.026277][ T4492] udevd[4492]: starting version 3.2.11
[ 63.617687][ T4493] udevd[4493]: starting eudev-3.2.11
[ 63.630423][ T4492] udevd (4492) used greatest stack depth: 5296 bytes left
[ 96.440761][ T1228] net_ratelimit: 2 callbacks suppressed
[ 96.440836][ T1228] aoe: packet could not be sent on lo. consider increasing tx_queue_len
[ 96.456284][ T1228] aoe: packet could not be sent on bond0. consider increasing tx_queue_len
[ 96.465416][ T1228] aoe: packet could not be sent on dummy0. consider increasing tx_queue_len
[ 96.474717][ T1228] aoe: packet could not be sent on eql. consider increasing tx_queue_len
[ 96.483772][ T1228] aoe: packet could not be sent on ifb0. consider increasing tx_queue_len
[ 96.492874][ T1228] aoe: packet could not be sent on ifb1. consider increasing tx_queue_len
[ 96.501891][ T1228] aoe: packet could not be sent on eth0. consider increasing tx_queue_len
[ 96.510890][ T1228] aoe: packet could not be sent on wlan0. consider increasing tx_queue_len
[ 96.520082][ T1228] aoe: packet could not be sent on wlan1. consider increasing tx_queue_len
[ 96.529236][ T1228] aoe: packet could not be sent on hwsim0. consider increasing tx_queue_len
done
Starting system message bus: done
Starting iptables: OK
Starting network: OK
Starting dhcpcd...
dhcpcd-9.4.1 starting
dev: loaded udev
DUID 00:04:c7:fd:4a:df:9d:a6:e9:60:55:7b:b4:5b:1f:77:00:5c
forked to background, child pid 4705
[ 111.191271][ T4706] 8021q: adding VLAN 0 to HW filter on device bond0
[ 111.209817][ T4706] eql: remember to turn off Van-Jacobson compression on your slave devices
[ 111.780216][ T43] cfg80211: failed to load regulatory.db
Starting sshd: OK
syzkaller
syzkaller login: [ 115.865683][ C0] =====================================================
[ 115.873160][ C0] BUG: KMSAN: uninit-value in receive_buf+0x25e3/0x5fd0
[ 115.880340][ C0] receive_buf+0x25e3/0x5fd0
[ 115.885254][ C0] virtnet_poll+0xd1c/0x23c0
[ 115.890052][ C0] __napi_poll+0xe7/0x980
[ 115.894742][ C0] net_rx_action+0x82a/0x1850
[ 115.899618][ C0] handle_softirqs+0x1d8/0x810
[ 115.904721][ C0] __irq_exit_rcu+0x68/0x120
[ 115.909582][ C0] irq_exit_rcu+0x12/0x20
[ 115.914958][ C0] common_interrupt+0x94/0xa0
[ 115.920273][ C0] asm_common_interrupt+0x2b/0x40
[ 115.925662][ C0] acpi_safe_halt+0x25/0x30
[ 115.930366][ C0] acpi_idle_do_entry+0x22/0x40
[ 115.935467][ C0] acpi_idle_enter+0xa1/0xc0
[ 115.940237][ C0] cpuidle_enter_state+0xcb/0x250
[ 115.945591][ C0] cpuidle_enter+0x7f/0xf0
[ 115.950171][ C0] do_idle+0x551/0x750
[ 115.954442][ C0] cpu_startup_entry+0x65/0x80
[ 115.959559][ C0] rest_init+0x1e8/0x260
[ 115.963993][ C0] start_kernel+0x927/0xa70
[ 115.968867][ C0] x86_64_start_reservations+0x2e/0x30
[ 115.975073][ C0] x86_64_start_kernel+0x98/0xa0
[ 115.980184][ C0] common_startup_64+0x12c/0x137
[ 115.985408][ C0]
[ 115.987817][ C0] Uninit was created at:
[ 115.992379][ C0] __alloc_pages+0x9d6/0xe70
[ 115.997124][ C0] alloc_pages_mpol+0x299/0x990
[ 116.002166][ C0] alloc_pages+0x1bf/0x1e0
[ 116.006928][ C0] skb_page_frag_refill+0x2bf/0x7c0
[ 116.012306][ C0] virtnet_rq_alloc+0x43/0xbb0
[ 116.017681][ C0] try_fill_recv+0x3f0/0x2f50
[ 116.022594][ C0] virtnet_open+0x1cc/0xb00
[ 116.027277][ C0] __dev_open+0x546/0x6f0
[ 116.031805][ C0] __dev_change_flags+0x309/0x9a0
[ 116.037006][ C0] dev_change_flags+0x8e/0x1d0
[ 116.042167][ C0] devinet_ioctl+0x13ec/0x22c0
[ 116.047162][ C0] inet_ioctl+0x4bd/0x6d0
[ 116.051595][ C0] sock_do_ioctl+0xb7/0x540
[ 116.056397][ C0] sock_ioctl+0x727/0xd70
[ 116.060877][ C0] __se_sys_ioctl+0x261/0x450
[ 116.065933][ C0] __x64_sys_ioctl+0x96/0xe0
[ 116.070733][ C0] x64_sys_call+0x1883/0x3b50
[ 116.075693][ C0] do_syscall_64+0xcf/0x1e0
[ 116.080462][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 116.087003][ C0]
[ 116.089406][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.9.0-syzkaller-07726-g3c999d1ae3c7-dirty #0
[ 116.099490][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
[ 116.109736][ C0] =====================================================
[ 116.116828][ C0] Disabling lock debugging due to kernel taint
[ 116.123111][ C0] Kernel panic - not syncing: kmsan.panic set ...
[ 116.129715][ C0] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G B 6.9.0-syzkaller-07726-g3c999d1ae3c7-dirty #0
[ 116.141815][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
[ 116.152174][ C0] Call Trace:
[ 116.155539][ C0] <IRQ>
[ 116.158586][ C0] dump_stack_lvl+0x216/0x2d0
[ 116.163397][ C0] ? kmsan_get_shadow_origin_ptr+0x4d/0xb0
[ 116.169531][ C0] dump_stack+0x1e/0x30
[ 116.173806][ C0] panic+0x4e2/0xcd0
[ 116.177900][ C0] ? kmsan_get_metadata+0xf1/0x1d0
[ 116.183138][ C0] kmsan_report+0x2d5/0x2e0
[ 116.187923][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 116.193246][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 116.198556][ C0] ? __msan_warning+0x95/0x120
[ 116.203515][ C0] ? receive_buf+0x25e3/0x5fd0
[ 116.208570][ C0] ? virtnet_poll+0xd1c/0x23c0
[ 116.213493][ C0] ? __napi_poll+0xe7/0x980
[ 116.218201][ C0] ? net_rx_action+0x82a/0x1850
[ 116.223142][ C0] ? handle_softirqs+0x1d8/0x810
[ 116.228219][ C0] ? __irq_exit_rcu+0x68/0x120
[ 116.233149][ C0] ? irq_exit_rcu+0x12/0x20
[ 116.237889][ C0] ? common_interrupt+0x94/0xa0
[ 116.242897][ C0] ? asm_common_interrupt+0x2b/0x40
[ 116.248227][ C0] ? acpi_safe_halt+0x25/0x30
[ 116.253054][ C0] ? acpi_idle_do_entry+0x22/0x40
[ 116.258300][ C0] ? acpi_idle_enter+0xa1/0xc0
[ 116.263183][ C0] ? cpuidle_enter_state+0xcb/0x250
[ 116.268497][ C0] ? cpuidle_enter+0x7f/0xf0
[ 116.273248][ C0] ? do_idle+0x551/0x750
[ 116.277699][ C0] ? cpu_startup_entry+0x65/0x80
[ 116.283030][ C0] ? rest_init+0x1e8/0x260
[ 116.287616][ C0] ? start_kernel+0x927/0xa70
[ 116.292494][ C0] ? x86_64_start_reservations+0x2e/0x30
[ 116.298261][ C0] ? x86_64_start_kernel+0x98/0xa0
[ 116.303657][ C0] ? common_startup_64+0x12c/0x137
[ 116.308897][ C0] ? kmsan_internal_memmove_metadata+0x17b/0x230
[ 116.315434][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 116.320737][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 116.326047][ C0] ? page_to_skb+0xdae/0x1620
[ 116.331013][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 116.336344][ C0] __msan_warning+0x95/0x120
[ 116.341038][ C0] receive_buf+0x25e3/0x5fd0
[ 116.345748][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 116.351067][ C0] ? kmsan_get_shadow_origin_ptr+0x4d/0xb0
[ 116.357172][ C0] virtnet_poll+0xd1c/0x23c0
[ 116.362001][ C0] ? __pfx_virtnet_poll+0x10/0x10
[ 116.367146][ C0] __napi_poll+0xe7/0x980
[ 116.371703][ C0] ? kmsan_get_metadata+0x146/0x1d0
[ 116.377048][ C0] net_rx_action+0x82a/0x1850
[ 116.381835][ C0] ? sched_clock_cpu+0x55/0x870
[ 116.386928][ C0] ? __pfx_net_rx_action+0x10/0x10
[ 116.392151][ C0] handle_softirqs+0x1d8/0x810
[ 116.397053][ C0] __irq_exit_rcu+0x68/0x120
[ 116.401871][ C0] irq_exit_rcu+0x12/0x20
[ 116.406445][ C0] common_interrupt+0x94/0xa0
[ 116.411335][ C0] </IRQ>
[ 116.414325][ C0] <TASK>
[ 116.417407][ C0] asm_common_interrupt+0x2b/0x40
[ 116.422551][ C0] RIP: 0010:acpi_safe_halt+0x25/0x30
[ 116.427969][ C0] Code: 90 90 90 90 90 55 48 89 e5 65 48 8b 04 25 c0 5c 0a 00 48 f7 00 08 00 00 00 75 10 66 90 0f 00 2d eb bd 51 00 f3 0f 1e fa fb f4 <fa> 5d c3 cc cc cc cc 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90
[ 116.447780][ C0] RSP: 0018:ffffffff91003ce8 EFLAGS: 00000246
[ 116.454059][ C0] RAX: ffffffff9102be00 RBX: ffffffff91483da0 RCX: 0000000000000001
[ 116.462289][ C0] RDX: ffff888103584c64 RSI: ffffffff91483da0 RDI: ffff888103584c64
[ 116.470655][ C0] RBP: ffffffff91003ce8 R08: ffffea000000000f R09: 00000000000000ff
[ 116.478730][ C0] R10: ffff88823f16fe02 R11: ffffffff8f8b99a0 R12: ffff8881064f0400
[ 116.487141][ C0] R13: ffffffff91483e20 R14: 0000000000000001 R15: 0000000000000001
[ 116.495298][ C0] ? __pfx_acpi_idle_enter+0x10/0x10
[ 116.500824][ C0] acpi_idle_do_entry+0x22/0x40
[ 116.505977][ C0] acpi_idle_enter+0xa1/0xc0
[ 116.510780][ C0] cpuidle_enter_state+0xcb/0x250
[ 116.515918][ C0] cpuidle_enter+0x7f/0xf0
[ 116.520615][ C0] do_idle+0x551/0x750
[ 116.524816][ C0] cpu_startup_entry+0x65/0x80
[ 116.529734][ C0] rest_init+0x1e8/0x260
[ 116.534092][ C0] start_kernel+0x927/0xa70
[ 116.538728][ C0] x86_64_start_reservations+0x2e/0x30
[ 116.544307][ C0] x86_64_start_kernel+0x98/0xa0
[ 116.549373][ C0] common_startup_64+0x12c/0x137
[ 116.554565][ C0] </TASK>
[ 116.558270][ C0] Kernel Offset: disabled
[ 116.563102][ C0] Rebooting in 86400 seconds..
syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.21.4'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build2973090537=/tmp/go-build -gno-record-gcc-switches'
git status (err=<nil>)
HEAD detached at 21339d7b9
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=21339d7b9986698282dce93709157dc36907fbf8 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240422-175005'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=21339d7b9986698282dce93709157dc36907fbf8 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240422-175005'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=21339d7b9986698282dce93709157dc36907fbf8 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240422-175005'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-stress github.com/google/syzkaller/tools/syz-stress
mkdir -p ./bin/linux_amd64
gcc -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"21339d7b9986698282dce93709157dc36907fbf8\"
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=17258884980000
Tested on:
commit: 3c999d1a Merge tag 'wq-for-6.10' of git://git.kernel.o..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=32e783ac1c83004e
dashboard link: https://syzkaller.appspot.com/bug?extid=5681e40d297b30f5b513
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=1164bc3f180000
For archival purposes, forwarding an incoming command email to
[email protected].
***
Subject: Test for 5681e40d297b30f5b513
Author: [email protected]
#syz test git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 71b1543c83d65af8215d7558d70fc2ecbee77dcf
diff --git a/net/can/j1939/main.c b/net/can/j1939/main.c
index a6fb89fa6278..7e8a20f2fc42 100644
--- a/net/can/j1939/main.c
+++ b/net/can/j1939/main.c
@@ -30,10 +30,6 @@ MODULE_ALIAS("can-proto-" __stringify(CAN_J1939));
/* CAN_HDR: #bytes before can_frame data part */
#define J1939_CAN_HDR (offsetof(struct can_frame, data))
-/* CAN_FTR: #bytes beyond data part */
-#define J1939_CAN_FTR (sizeof(struct can_frame) - J1939_CAN_HDR - \
- sizeof(((struct can_frame *)0)->data))
-
/* lowest layer */
static void j1939_can_recv(struct sk_buff *iskb, void *data)
{
@@ -342,7 +338,7 @@ int j1939_send_one(struct j1939_priv *priv, struct sk_buff *skb)
memset(cf, 0, J1939_CAN_HDR);
/* make it a full can frame again */
- skb_put(skb, J1939_CAN_FTR + (8 - dlc));
+ skb_put_zero(skb, 8 - dlc);
canid = CAN_EFF_FLAG |
(skcb->priority << 26) |
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: [email protected]
Tested on:
commit: 71b1543c Merge tag '6.9-rc5-ksmbd-fixes' of git://git...
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=17cf9ed0980000
kernel config: https://syzkaller.appspot.com/x/.config?x=776c05250f36d55c
dashboard link: https://syzkaller.appspot.com/bug?extid=5681e40d297b30f5b513
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=106cbf70980000
Note: testing is done by a robot and is best-effort only.