Received-SPF: pass (google.com: domain of linux-kernel+bounces-152997-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
Precedence: bulk
MIME-Version: 1.0
References: <000000000000826ac1061675b0e3@google.com>
In-Reply-To: <000000000000826ac1061675b0e3@google.com>
From: Alexander Potapenko <glider@google.com>
Date: Mon, 22 Apr 2024 10:39:31 +0200
Message-ID: <CAG_fn=Xt=i_EqRbbceS-GSo5voAF-9GO0ZBMykX3LwyffaU9NA@mail.gmail.com>
Subject: Re: [syzbot] [net?] KMSAN: uninit-value in unwind_dump
To: syzbot <syzbot+355c5bb8c1445c871ee8@syzkaller.appspotmail.com>
Cc: davem@davemloft.net, edumazet@google.com, kuba@kernel.org, 
	linux-kernel@vger.kernel.org, netdev@vger.kernel.org, pabeni@redhat.com, 
	syzkaller-bugs@googlegroups.com
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Fri, Apr 19, 2024 at 6:36=E2=80=AFPM syzbot
<syzbot+355c5bb8c1445c871ee8@syzkaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit:    0bbac3facb5d Linux 6.9-rc4
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=3D13403bcb18000=
0
> kernel config:  https://syzkaller.appspot.com/x/.config?x=3D87a805e655619=
c64
> dashboard link: https://syzkaller.appspot.com/bug?extid=3D355c5bb8c1445c8=
71ee8
> compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Deb=
ian) 2.40
>
> Unfortunately, I don't have any reproducer for this issue yet.
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/93eb2bab28b5/dis=
k-0bbac3fa.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/47a883d2dfaa/vmlinu=
x-0bbac3fa.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/6bc56900ec1d/b=
zImage-0bbac3fa.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the comm=
it:
> Reported-by: syzbot+355c5bb8c1445c871ee8@syzkaller.appspotmail.com
>
> WARNING: kernel stack frame pointer at ffff88813fd05fe8 in kworker/1:1:42=
 has bad value ffff888103513fe8
> unwind stack type:0 next_sp:ffff888103513fd8 mask:0x4 graph_idx:0
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D
> BUG: KMSAN: uninit-value in unwind_dump+0x5a0/0x730 arch/x86/kernel/unwin=
d_frame.c:60
>  unwind_dump+0x5a0/0x730 arch/x86/kernel/unwind_frame.c:60
>  unwind_next_frame+0x2d6/0x470
>  arch_stack_walk+0x1ec/0x2d0 arch/x86/kernel/stacktrace.c:25
>  stack_trace_save+0xaa/0xe0 kernel/stacktrace.c:122
>  ref_tracker_free+0x103/0xec0 lib/ref_tracker.c:239
>  __netns_tracker_free include/net/net_namespace.h:348 [inline]
>  put_net_track include/net/net_namespace.h:363 [inline]
>  __sk_destruct+0x5aa/0xb70 net/core/sock.c:2204
>  sk_destruct net/core/sock.c:2223 [inline]
>  __sk_free+0x6de/0x760 net/core/sock.c:2234
>  sk_free+0x70/0xc0 net/core/sock.c:2245
>  deferred_put_nlk_sk+0x243/0x270 net/netlink/af_netlink.c:744
>  rcu_do_batch kernel/rcu/tree.c:2196 [inline]
>  rcu_core+0xa59/0x1e70 kernel/rcu/tree.c:2471
>  rcu_core_si+0x12/0x20 kernel/rcu/tree.c:2488
>  __do_softirq+0x1c0/0x7d7 kernel/softirq.c:554
>  invoke_softirq kernel/softirq.c:428 [inline]
>  __irq_exit_rcu kernel/softirq.c:633 [inline]
>  irq_exit_rcu+0x6a/0x130 kernel/softirq.c:645
>  instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inli=
ne]
>  sysvec_apic_timer_interrupt+0x83/0x90 arch/x86/kernel/apic/apic.c:1043
>
> Local variable tx created at:
>  ieee80211_get_buffered_bc+0x44/0x970 net/mac80211/tx.c:5886
>  mac80211_hwsim_beacon_tx+0x63b/0xb40 drivers/net/wireless/virtual/mac802=
11_hwsim.c:2303
>
> CPU: 1 PID: 42 Comm: kworker/1:1 Not tainted 6.9.0-rc4-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS G=
oogle 03/27/2024
> Workqueue: usb_hub_wq hub_event
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D

This seems to be a false positive caused by KMSAN instrumenting
READ_ONCE_NOCHECK(), although it is not supposed to.
I was going to define it as follows under __SANITIZE_MEMORY__:

  #define __no_sanitize_or_inline __no_kmsan_checks notrace __maybe_unused

, but I find the name __no_sanitize_or_inline a bit unfortunate
because it doesn't distinguish between "do not instrument this code"
and "do not report bugs in this code", which have different meanings
from KMSAN perspective.