On Wed, Jan 24, 2024 at 11:47:32AM +0100, Alexander Potapenko wrote: > On Thu, Jan 4, 2024 at 9:45 PM Stefan Hajnoczi <stefanha@xxxxxxxxxx> wrote: > > > > On Tue, Jan 02, 2024 at 08:03:46AM -0500, Michael S. Tsirkin wrote: > > > On Mon, Jan 01, 2024 at 05:38:24AM -0800, syzbot wrote: > > > > Hello, > > > > > > > > syzbot found the following issue on: > > > > > > > > HEAD commit: fbafc3e621c3 Merge tag 'for_linus' of git://git.kernel.org.. > > > > git tree: upstream > > > > console+strace: https://syzkaller.appspot.com/x/log.txt?x=173df3e9e80000 > > > > kernel config: https://syzkaller.appspot.com/x/.config?x=e0c7078a6b901aa3 > > > > dashboard link: https://syzkaller.appspot.com/bug?extid=d7521c1e3841ed075a42 > > > > compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 > > > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1300b4a1e80000 > > > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=130b0379e80000 > > > > > > > > Downloadable assets: > > > > disk image: https://storage.googleapis.com/syzbot-assets/1520f7b6daa4/disk-fbafc3e6.raw.xz > > > > vmlinux: https://storage.googleapis.com/syzbot-assets/8b490af009d5/vmlinux-fbafc3e6.xz > > > > kernel image: https://storage.googleapis.com/syzbot-assets/202ca200f4a4/bzImage-fbafc3e6.xz > > > > > > > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > > > > Reported-by: syzbot+d7521c1e3841ed075a42@xxxxxxxxxxxxxxxxxxxxxxxxx > > > > > > > > ===================================================== > > > > Hi Alexander, > > Please take a look at this KMSAN failure. The uninitialized memory was > > created for the purpose of writing a coredump. vring_map_one_sg() should > > have direction=DMA_TO_DEVICE. > > > Hi Stefan, > > I took a closer look, and am pretty confident this is a false positive. > I tried adding memset(..., 0xab, PAGE_SIZE << order) to alloc_pages() > and never saw > the 0xab pattern in the buffers for which KMSAN reported an error. > > This probably isn't an error in 88938359e2df ("virtio: kmsan: > check/unpoison scatterlist in > vring_map_one_sg()"), which by itself should be doing a sane thing: > report an error if an > uninitialized buffer is passed to it. It is more likely that we're > missing some initialization that > happens in coredump.c > > Does anyone have an idea where coredump.c is supposed to be > initializing these pages? > Maybe there are some inline assembly functions involved in copying the data? Thanks for your time looking into this! Stefan
Attachment:
signature.asc
Description: PGP signature
