Hello,
syzbot found the following crash on:
HEAD commit: c2453450 kmsan: kcov: prettify the code unpoisoning area->..
git tree: https://github.com/google/kmsan.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=1159ab53600000
kernel config: https://syzkaller.appspot.com/x/.config?x=3684f3c73f43899a
dashboard link: https://syzkaller.appspot.com/bug?extid=7dc7c28d4577bbe55b10
compiler: clang version 9.0.0 (/home/glider/llvm/clang
80fee25776c2fb61e74c1ecb1a523375c2500b69)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17e7276f600000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15609b30e00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: [email protected]
asix 1-1:0.145 (unnamed net_device) (uninitialized): Failed to enable
software MII access
asix 1-1:0.145 (unnamed net_device) (uninitialized): Failed to read reg
index 0x0000: -71
=====================================================
BUG: KMSAN: uninit-value in asix_mdio_write+0x3fa/0x8d0
drivers/net/usb/asix_common.c:496
CPU: 1 PID: 17 Comm: kworker/1:0 Not tainted 5.4.0-rc3+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: usb_hub_wq hub_event
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x191/0x1f0 lib/dump_stack.c:113
kmsan_report+0x14a/0x2f0 mm/kmsan/kmsan_report.c:109
__msan_warning+0x73/0xf0 mm/kmsan/kmsan_instr.c:245
asix_mdio_write+0x3fa/0x8d0 drivers/net/usb/asix_common.c:496
asix_phy_reset+0xd8/0x2d0 drivers/net/usb/asix_devices.c:208
ax88172_bind+0x780/0xbd0 drivers/net/usb/asix_devices.c:272
usbnet_probe+0x10d3/0x39d0 drivers/net/usb/usbnet.c:1730
usb_probe_interface+0xd19/0x1310 drivers/usb/core/driver.c:361
really_probe+0xd91/0x1f90 drivers/base/dd.c:552
driver_probe_device+0x1ba/0x510 drivers/base/dd.c:721
__device_attach_driver+0x5b8/0x790 drivers/base/dd.c:828
bus_for_each_drv+0x28e/0x3b0 drivers/base/bus.c:430
__device_attach+0x489/0x750 drivers/base/dd.c:894
device_initial_probe+0x4a/0x60 drivers/base/dd.c:941
bus_probe_device+0x131/0x390 drivers/base/bus.c:490
device_add+0x25b5/0x2df0 drivers/base/core.c:2201
usb_set_configuration+0x309f/0x3710 drivers/usb/core/message.c:2027
generic_probe+0xe7/0x280 drivers/usb/core/generic.c:210
usb_probe_device+0x146/0x200 drivers/usb/core/driver.c:266
really_probe+0xd91/0x1f90 drivers/base/dd.c:552
driver_probe_device+0x1ba/0x510 drivers/base/dd.c:721
__device_attach_driver+0x5b8/0x790 drivers/base/dd.c:828
bus_for_each_drv+0x28e/0x3b0 drivers/base/bus.c:430
__device_attach+0x489/0x750 drivers/base/dd.c:894
device_initial_probe+0x4a/0x60 drivers/base/dd.c:941
bus_probe_device+0x131/0x390 drivers/base/bus.c:490
device_add+0x25b5/0x2df0 drivers/base/core.c:2201
usb_new_device+0x23e5/0x2fb0 drivers/usb/core/hub.c:2536
hub_port_connect drivers/usb/core/hub.c:5098 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
port_event drivers/usb/core/hub.c:5359 [inline]
hub_event+0x581d/0x72f0 drivers/usb/core/hub.c:5441
process_one_work+0x1572/0x1ef0 kernel/workqueue.c:2269
worker_thread+0x111b/0x2460 kernel/workqueue.c:2415
kthread+0x4b5/0x4f0 kernel/kthread.c:256
ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:355
Local variable description: ----smsr@asix_mdio_write
Variable was created at:
asix_mdio_write+0xc7/0x8d0 drivers/net/usb/asix_common.c:480
asix_mdio_write+0xc7/0x8d0 drivers/net/usb/asix_common.c:480
=====================================================
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at [email protected].
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches
The local variables use without initilization value.
This fixes the syzbot report.
Reported-by: [email protected]
Test result:
https://groups.google.com/d/msg/syzkaller-bugs/3H_n05x_sPU/sUoHhxgAAgAJ
Signed-off-by: Phong Tran <[email protected]>
---
drivers/net/usb/asix_common.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c
index e39f41efda3e..3c7ccd8a9da8 100644
--- a/drivers/net/usb/asix_common.c
+++ b/drivers/net/usb/asix_common.c
@@ -444,8 +444,8 @@ void asix_set_multicast(struct net_device *net)
int asix_mdio_read(struct net_device *netdev, int phy_id, int loc)
{
struct usbnet *dev = netdev_priv(netdev);
- __le16 res;
- u8 smsr;
+ __le16 res = 0;
+ u8 smsr = 0;
int i = 0;
int ret;
@@ -478,7 +478,7 @@ void asix_mdio_write(struct net_device *netdev, int phy_id, int loc, int val)
{
struct usbnet *dev = netdev_priv(netdev);
__le16 res = cpu_to_le16(val);
- u8 smsr;
+ u8 smsr = 0;
int i = 0;
int ret;
@@ -508,8 +508,8 @@ void asix_mdio_write(struct net_device *netdev, int phy_id, int loc, int val)
int asix_mdio_read_nopm(struct net_device *netdev, int phy_id, int loc)
{
struct usbnet *dev = netdev_priv(netdev);
- __le16 res;
- u8 smsr;
+ __le16 res = 0;
+ u8 smsr = 0;
int i = 0;
int ret;
@@ -543,7 +543,7 @@ asix_mdio_write_nopm(struct net_device *netdev, int phy_id, int loc, int val)
{
struct usbnet *dev = netdev_priv(netdev);
__le16 res = cpu_to_le16(val);
- u8 smsr;
+ u8 smsr = 0;
int i = 0;
int ret;
--
2.20.1
From: Phong Tran <[email protected]>
Date: Thu, 7 Nov 2019 07:44:04 +0700
> The local variables use without initilization value.
> This fixes the syzbot report.
>
> Reported-by: [email protected]
>
> Test result:
>
> https://groups.google.com/d/msg/syzkaller-bugs/3H_n05x_sPU/sUoHhxgAAgAJ
>
> Signed-off-by: Phong Tran <[email protected]>
There are several more situations in this file where the data blob passed
to asix_read_cmd() is read without pre-initialization not checking the
return value from asix_read_cmd().
So, syzbot can see some of them but not all of them, yet all of them
are buggy and should be fixed.
These kinds of patches drive me absolutely crazy :-)
Really, one of two things needs to happen, either asix_read_cmd() clears
the incoming buffer unconditionally, or these call sites strictly must
check the return value always before accessing the buffer after the call.
I'm not applying this, sorry.
This is for fixing KMSAN: uninit-value in asix_mdio_write
comes from syzbot.
Reported-by: [email protected]
Tested by:
https://groups.google.com/d/msg/syzkaller-bugs/3H_n05x_sPU/07UIX_TUEgAJ
Signed-off-by: Phong Tran <[email protected]>
---
drivers/net/usb/asix_common.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c
index e39f41efda3e..f3eeb7875a4d 100644
--- a/drivers/net/usb/asix_common.c
+++ b/drivers/net/usb/asix_common.c
@@ -22,6 +22,8 @@ int asix_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
else
fn = usbnet_read_cmd_nopm;
+ memset(data, 0, size);
+
ret = fn(dev, cmd, USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
value, index, data, size);
--
2.20.1
On 11/8/19 6:21 AM, David Miller wrote:
> From: Phong Tran <[email protected]>
> Date: Thu, 7 Nov 2019 07:44:04 +0700
>
>> The local variables use without initilization value.
>> This fixes the syzbot report.
>>
>> Reported-by: [email protected]
>>
>> Test result:
>>
>> https://groups.google.com/d/msg/syzkaller-bugs/3H_n05x_sPU/sUoHhxgAAgAJ
>>
>> Signed-off-by: Phong Tran <[email protected]>
>
> There are several more situations in this file where the data blob passed
> to asix_read_cmd() is read without pre-initialization not checking the
> return value from asix_read_cmd().
>
> So, syzbot can see some of them but not all of them, yet all of them
> are buggy and should be fixed.
>
> These kinds of patches drive me absolutely crazy :-)
>
> Really, one of two things needs to happen, either asix_read_cmd() clears
> the incoming buffer unconditionally,
thank you for your suggestion.
Sent Patch v2 reply-to this mail thread.
regards,
Phong.