Received-SPF: pass (google.com: domain of linux-kernel+bounces-39995-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
Precedence: bulk
MIME-Version: 1.0
References: <000000000000fd588e060de27ef4@google.com> <tencent_613652973C377A4AEC7507777B66C63C8309@qq.com>
In-Reply-To: <tencent_613652973C377A4AEC7507777B66C63C8309@qq.com>
From: Alexander Potapenko <glider@google.com>
Date: Fri, 26 Jan 2024 11:19:58 +0100
Message-ID: <CAG_fn=WpdcrDjxSzPxhRzEGp3jFtp==1DkfkovoF39kUgkjB6w@mail.gmail.com>
Subject: Re: [syzbot] [virtualization?] KMSAN: uninit-value in virtqueue_add (4)
To: Edward Adam Davis <eadavis@qq.com>
Cc: syzbot+d7521c1e3841ed075a42@syzkaller.appspotmail.com, 
	linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Fri, Jan 26, 2024 at 2:36=E2=80=AFAM 'Edward Adam Davis' via syzkaller-b=
ugs
<syzkaller-bugs@googlegroups.com> wrote:
>
> please test uninit-value in virtqueue_add (4)

Hi Edward,

KMSAN is currently broken at trunk, see
https://lore.kernel.org/linux-mm/20240115184430.2710652-1-glider@google.com=
/
Therefore syzbot is unable to test patches before a couple of changes
reach upstream.

I checked your patch, and it is still triggering the same bug, which
is expected, because there are whole uninitialized pages, and the
patch below only initializes two instances of struct scatterlist that
are unlikely to be cloned to fill those pages.
There must be some non-instrumented code that fills those pages with
data, e.g. a DMA write, an assembly routine or some VM-to-kernel
interaction that KMSAN fails to handle.

>
> #syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.=
git fbafc3e621c3
>
> diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
> index 9d1bdcdc1331..4ca6627a7459 100644
> --- a/drivers/scsi/virtio_scsi.c
> +++ b/drivers/scsi/virtio_scsi.c
> @@ -427,7 +427,7 @@ static int __virtscsi_add_cmd(struct virtqueue *vq,
>                             size_t req_size, size_t resp_size)
>  {
>         struct scsi_cmnd *sc =3D cmd->sc;
> -       struct scatterlist *sgs[6], req, resp;
> +       struct scatterlist *sgs[6], req =3D {}, resp =3D {};
>         struct sg_table *out, *in;
>         unsigned out_num =3D 0, in_num =3D 0;