Re: KMSAN: uninit-value in audit_log_vformat (2)

[Paul Moore]

On Mon, Apr 20, 2020 at 2:12 PM Dmitry Vyukov <dvyukov@xxxxxxxxxx> wrote:
> On Mon, Apr 20, 2020 at 6:29 PM Paul Moore <paul@xxxxxxxxxxxxxx> wrote:
> > On Mon, Apr 20, 2020 at 1:35 AM syzbot
> > <syzbot+49e69b4d71a420ceda3e@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
> > >
> > > Hello,
> > >
> > > syzbot found the following crash on:
> > >
> > > HEAD commit:    5356842d [EXPERIMENTAL] kmsan: eagerly allocate shadow at ..
> > > git tree:       https://github.com/google/kmsan.git master
> > > console output: https://syzkaller.appspot.com/x/log.txt?x=12f06720100000
> > > kernel config:  https://syzkaller.appspot.com/x/.config?x=a5915107b3106aaa
> > > dashboard link: https://syzkaller.appspot.com/bug?extid=49e69b4d71a420ceda3e
> > > compiler:       clang version 10.0.0 (https://github.com/llvm/llvm-project/ c2443155a0fb245c8f17f2c1c72b6ea391e86e81)
> > > userspace arch: i386
> > > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=133b5dabe00000
> > > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=143e1610100000
> > >
> > > IMPORTANT: if you fix the bug, please add the following tag to the commit:
> > > Reported-by: syzbot+49e69b4d71a420ceda3e@xxxxxxxxxxxxxxxxxxxxxxxxx
> > >
> > > =====================================================
> > > BUG: KMSAN: uninit-value in string_nocheck lib/vsprintf.c:608 [inline]
> > > BUG: KMSAN: uninit-value in string+0x522/0x690 lib/vsprintf.c:689
> > > CPU: 1 PID: 8854 Comm: syz-executor694 Not tainted 5.6.0-rc7-syzkaller #0
> > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> > > Call Trace:
> > >  __dump_stack lib/dump_stack.c:77 [inline]
> > >  dump_stack+0x1c9/0x220 lib/dump_stack.c:118
> > >  kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118
> > >  __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215
> > >  string_nocheck lib/vsprintf.c:608 [inline]
> > >  string+0x522/0x690 lib/vsprintf.c:689
> > >  vsnprintf+0x207d/0x31b0 lib/vsprintf.c:2574
> >
> > Are there any ongoing problems with [vsn]printf() in the kernel at the
> > moment with syzbot?
> >
> > I ask because on first look I'm not seeing any obvious problems in the
> > audit portion of this code path.
>
> None I am aware of. Alex?
> Can it be related to data_len==0? I don't see any obvious checks for
> this. And in that case will 0-terminate out-of-bounds (at offset -1?)
> and print potentially uninit data. But I looked at the code only very
> briefly so potentially I am totally wrong.

Bingo, that's likely it.  Thanks.

I was in the process of fixing another audit bug when I looked at this
and got fixated on the varg stuff, not the variables themselves.  I'll
have a patch out later today.

-- 
paul moore
www.paul-moore.com