On 3/16/24 13:37, syzbot wrote:
Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: KMSAN: uninit-value in io_sendrecv_fail
diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 3ae4bb988906..826989e2f601 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -1063,6 +1063,7 @@ static void io_preinit_req(struct io_kiocb *req, struct io_ring_ctx *ctx) /* not necessary, but safer to zero */ memset(&req->cqe, 0, sizeof(req->cqe)); memset(&req->big_cqe, 0, sizeof(req->big_cqe)); + memset(&req->cmd, 0, sizeof(req->cmd)); } What's the point of testing it? You said it yourself, it hides the problem under the carpet but doesn't solve it. Do some valid IO first, then send that failed request. If done_io is aliased with with some interesting field of a previously completed request you're royally screwed, but syz would be just happy about it. It's likely that syz is complaining about is the early fail case I told about yesterday.
===================================================== BUG: KMSAN: uninit-value in io_sendrecv_fail+0x91/0x1e0 io_uring/net.c:1341 io_sendrecv_fail+0x91/0x1e0 io_uring/net.c:1341 io_req_defer_failed+0x3bd/0x610 io_uring/io_uring.c:1050 io_queue_sqe_fallback+0x1e3/0x280 io_uring/io_uring.c:2126 io_submit_fail_init+0x4e1/0x790 io_uring/io_uring.c:2304 io_submit_sqes+0x19cd/0x2fb0 io_uring/io_uring.c:2480 __do_sys_io_uring_enter io_uring/io_uring.c:3656 [inline] __se_sys_io_uring_enter+0x409/0x4390 io_uring/io_uring.c:3591 __x64_sys_io_uring_enter+0x11b/0x1a0 io_uring/io_uring.c:3591 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Uninit was created at: __alloc_pages+0x9a6/0xe00 mm/page_alloc.c:4592 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] alloc_slab_page mm/slub.c:2190 [inline] allocate_slab mm/slub.c:2354 [inline] new_slab+0x2d7/0x1400 mm/slub.c:2407 ___slab_alloc+0x16b5/0x3970 mm/slub.c:3540 __kmem_cache_alloc_bulk mm/slub.c:4574 [inline] kmem_cache_alloc_bulk+0x52a/0x1440 mm/slub.c:4648 __io_alloc_req_refill+0x248/0x780 io_uring/io_uring.c:1101 io_alloc_req io_uring/io_uring.h:405 [inline] io_submit_sqes+0xaa1/0x2fb0 io_uring/io_uring.c:2469 __do_sys_io_uring_enter io_uring/io_uring.c:3656 [inline] __se_sys_io_uring_enter+0x409/0x4390 io_uring/io_uring.c:3591 __x64_sys_io_uring_enter+0x11b/0x1a0 io_uring/io_uring.c:3591 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b CPU: 0 PID: 5482 Comm: syz-executor.0 Not tainted 6.8.0-syzkaller-00721-g6c677dd4eac2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 ===================================================== Tested on: commit: 6c677dd4 io_uring/net: ensure async prep handlers alwa.. git tree: git://git.kernel.dk/linux.git io_uring-6.9 console output: https://syzkaller.appspot.com/x/log.txt?x=17f26711180000 kernel config: https://syzkaller.appspot.com/x/.config?x=a271c5dca0ff14df dashboard link: https://syzkaller.appspot.com/bug?extid=f8e9a371388aa62ecab4 compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 Note: no patches were applied.
-- Pavel Begunkov
