Received-SPF: pass (google.com: domain of linux-kernel+bounces-37689-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
Date: Wed, 24 Jan 2024 16:25:31 -0500
From: Stefan Hajnoczi <stefanha@redhat.com>
To: Alexander Potapenko <glider@google.com>
Cc: syzbot <syzbot+d7521c1e3841ed075a42@syzkaller.appspotmail.com>,
	jasowang@redhat.com, linux-kernel@vger.kernel.org,
	syzkaller-bugs@googlegroups.com, virtualization@lists.linux.dev,
	xuanzhuo@linux.alibaba.com, bonzini@redhat.com,
	"Michael S. Tsirkin" <mst@redhat.com>
Subject: Re: [syzbot] [virtualization?] KMSAN: uninit-value in virtqueue_add
 (4)
Message-ID: <20240124212531.GA609846@fedora>
References: <000000000000fd588e060de27ef4@google.com>
 <20240102080315-mutt-send-email-mst@kernel.org>
 <20240104204531.GB954424@fedora>
 <CAG_fn=XmxeUePHFth5asQvHvo3=QSL4tB4yS5_3UVHWYJ=VRnw@mail.gmail.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="+9Fevo6zOXwDxbTS"
Content-Disposition: inline
In-Reply-To: <CAG_fn=XmxeUePHFth5asQvHvo3=QSL4tB4yS5_3UVHWYJ=VRnw@mail.gmail.com>


--+9Fevo6zOXwDxbTS
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Wed, Jan 24, 2024 at 11:47:32AM +0100, Alexander Potapenko wrote:
> On Thu, Jan 4, 2024 at 9:45=E2=80=AFPM Stefan Hajnoczi <stefanha@redhat.c=
om> wrote:
> >
> > On Tue, Jan 02, 2024 at 08:03:46AM -0500, Michael S. Tsirkin wrote:
> > > On Mon, Jan 01, 2024 at 05:38:24AM -0800, syzbot wrote:
> > > > Hello,
> > > >
> > > > syzbot found the following issue on:
> > > >
> > > > HEAD commit:    fbafc3e621c3 Merge tag 'for_linus' of git://git.ker=
nel.org..
> > > > git tree:       upstream
> > > > console+strace: https://syzkaller.appspot.com/x/log.txt?x=3D173df3e=
9e80000
> > > > kernel config:  https://syzkaller.appspot.com/x/.config?x=3De0c7078=
a6b901aa3
> > > > dashboard link: https://syzkaller.appspot.com/bug?extid=3Dd7521c1e3=
841ed075a42
> > > > compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils f=
or Debian) 2.40
> > > > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=3D1300b=
4a1e80000
> > > > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=3D130b037=
9e80000
> > > >
> > > > Downloadable assets:
> > > > disk image: https://storage.googleapis.com/syzbot-assets/1520f7b6da=
a4/disk-fbafc3e6.raw.xz
> > > > vmlinux: https://storage.googleapis.com/syzbot-assets/8b490af009d5/=
vmlinux-fbafc3e6.xz
> > > > kernel image: https://storage.googleapis.com/syzbot-assets/202ca200=
f4a4/bzImage-fbafc3e6.xz
> > > >
> > > > IMPORTANT: if you fix the issue, please add the following tag to th=
e commit:
> > > > Reported-by: syzbot+d7521c1e3841ed075a42@syzkaller.appspotmail.com
> > > >
> > > > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D
> >
> > Hi Alexander,
> > Please take a look at this KMSAN failure. The uninitialized memory was
> > created for the purpose of writing a coredump. vring_map_one_sg() should
> > have direction=3DDMA_TO_DEVICE.
> >
> Hi Stefan,
>=20
> I took a closer look, and am pretty confident this is a false positive.
> I tried adding memset(..., 0xab, PAGE_SIZE << order) to alloc_pages()
> and never saw
> the 0xab pattern in the buffers for which KMSAN reported an error.
>=20
> This probably isn't an error in 88938359e2df ("virtio: kmsan:
> check/unpoison scatterlist in
> vring_map_one_sg()"), which by itself should be doing a sane thing:
> report an error if an
> uninitialized buffer is passed to it. It is more likely that we're
> missing some initialization that
> happens in coredump.c
>=20
> Does anyone have an idea where coredump.c is supposed to be
> initializing these pages?
> Maybe there are some inline assembly functions involved in copying the da=
ta?

Thanks for your time looking into this!

Stefan

--+9Fevo6zOXwDxbTS
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEhpWov9P5fNqsNXdanKSrs4Grc8gFAmWxgEsACgkQnKSrs4Gr
c8g5nggAnQrG/GK26Vn5GTy1wTUizYD03FNIfC70/y/8Rd9SrJFdeWXRMzpZ2qiv
Z6Cb3iKUk0deWxwy6XfuL2aS98DOB1kb2YbaN9cGh4tvEYNZ+zCOL0aoY6o93G6k
aUwv8tX/DoeMi92qcZjF537N5P+JjACbyRHUHpp3d1t1wM+YIaxRk4bHdCkp+F64
Hb8Uo6VCzMjJxAb6Cpmx8KtOybo+CjDTISxKyVLPcQWYQP48Ase97qJzrqM7rkLw
2EbToh3I9fesLeK90qxJUE3oaxPIjN/YVq1+LEODn2xySDethoaF8TjRYNqwSgES
at7PN1XJQXF4GI1RuvU7AzQz4MC4MQ==
=gWOt
-----END PGP SIGNATURE-----

--+9Fevo6zOXwDxbTS--