KMSAN: uninit-value in __dma_map_sg_attrs

[Dipanjan Das]

Hi,

We would like to report the following bug which has been found by our
modified version of syzkaller.

======================================================
description: KMSAN: uninit-value in __dma_map_sg_attrs
affected file: kernel/dma/mapping.c
kernel version: 6.2.0-rc5
kernel commit: 41c66f47061608dc1fd493eebce198f0e74cc2d7
git tree: kmsan
kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=a9a22da1efde3af6
crash reproducer: attached
======================================================
Crash log:
======================================================
BUG: KMSAN: uninit-value in __dma_map_sg_attrs+0x1f3/0x2e0
kernel/dma/mapping.c:200
 __dma_map_sg_attrs+0x1f3/0x2e0 kernel/dma/mapping.c:200
 dma_map_sg_attrs+0x4a/0x60 kernel/dma/mapping.c:232
 ata_sg_setup drivers/ata/libata-core.c:4544 [inline]
 ata_qc_issue+0x958/0x1480 drivers/ata/libata-core.c:4845
 ata_scsi_translate drivers/ata/libata-scsi.c:1745 [inline]
 __ata_scsi_queuecmd+0x161c/0x16c0 drivers/ata/libata-scsi.c:4023
 ata_scsi_queuecmd+0x86d/0x970 drivers/ata/libata-scsi.c:4068
 scsi_dispatch_cmd drivers/scsi/scsi_lib.c:1517 [inline]
 scsi_queue_rq+0x478f/0x55c0 drivers/scsi/scsi_lib.c:1758
 blk_mq_dispatch_rq_list+0x13e9/0x40f0 block/blk-mq.c:2056
 __blk_mq_do_dispatch_sched block/blk-mq-sched.c:173 [inline]
 blk_mq_do_dispatch_sched+0xd97/0x1630 block/blk-mq-sched.c:187
 __blk_mq_sched_dispatch_requests+0x495/0x620
 blk_mq_sched_dispatch_requests+0x146/0x2b0 block/blk-mq-sched.c:339
 __blk_mq_run_hw_queue+0xf7/0x310 block/blk-mq.c:2174
 __blk_mq_delay_run_hw_queue+0x13c/0x6b0 block/blk-mq.c:2250
 blk_mq_run_hw_queue+0x527/0x850 block/blk-mq.c:2298
 blk_mq_sched_insert_requests+0x50f/0x7d0 block/blk-mq-sched.c:493
 blk_mq_dispatch_plug_list block/blk-mq.c:2758 [inline]
 blk_mq_flush_plug_list+0x752/0x1300 block/blk-mq.c:2800
 __blk_flush_plug+0x600/0x680 block/blk-core.c:1137
 blk_finish_plug+0x71/0x90 block/blk-core.c:1161
 ext4_do_writepages+0x5c84/0x6e40 fs/ext4/inode.c:2928
 ext4_writepages+0x2bc/0x660 fs/ext4/inode.c:2965
 do_writepages+0x475/0x930 mm/page-writeback.c:2581
 filemap_fdatawrite_wbc+0x1c4/0x260 mm/filemap.c:388
 __filemap_fdatawrite_range mm/filemap.c:421 [inline]
 file_write_and_wait_range+0x22f/0x410 mm/filemap.c:777
 ext4_sync_file+0x1ef/0x15b0 fs/ext4/fsync.c:151
 vfs_fsync_range+0x1ee/0x240 fs/sync.c:188
 generic_write_sync include/linux/fs.h:2885 [inline]
 ext4_buffered_write_iter+0xaa3/0xb90 fs/ext4/file.c:292
 ext4_file_write_iter+0xc9c/0x3350
 do_iter_write+0x645/0x12e0 fs/read_write.c:861
 vfs_writev+0x307/0x750 fs/read_write.c:934
 do_pwritev fs/read_write.c:1031 [inline]
 __do_sys_pwritev2 fs/read_write.c:1090 [inline]
 __se_sys_pwritev2+0x275/0x480 fs/read_write.c:1081
 __x64_sys_pwritev2+0xe0/0x140 fs/read_write.c:1081
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Uninit was created at:
 __alloc_pages+0x767/0xee0 mm/page_alloc.c:5572
 alloc_pages+0xa9a/0xd90 mm/mempolicy.c:2286
 folio_alloc+0x41/0x100 mm/mempolicy.c:2296
 filemap_alloc_folio+0xa5/0x450 mm/filemap.c:972
 __filemap_get_folio+0xe7c/0x1960 mm/filemap.c:1966
 pagecache_get_page+0x46/0x270 mm/folio-compat.c:98
 grab_cache_page_write_begin+0x51/0x70 mm/folio-compat.c:110
 ext4_write_begin+0x3d8/0x31d0 fs/ext4/inode.c:1194
 ext4_da_write_begin+0x5f4/0x11c0 fs/ext4/inode.c:3058
 generic_perform_write+0x376/0xc50 mm/filemap.c:3772
 ext4_buffered_write_iter+0x583/0xb90 fs/ext4/file.c:285
 ext4_file_write_iter+0xc9c/0x3350
 do_iter_write+0x645/0x12e0 fs/read_write.c:861
 vfs_writev+0x307/0x750 fs/read_write.c:934
 do_pwritev fs/read_write.c:1031 [inline]
 __do_sys_pwritev2 fs/read_write.c:1090 [inline]
 __se_sys_pwritev2+0x275/0x480 fs/read_write.c:1081
 __x64_sys_pwritev2+0xe0/0x140 fs/read_write.c:1081
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Bytes 0-1279 of 4096 are uninitialized
Memory access of size 4096 starts at ffff8880324c6000

CPU: 0 PID: 24178 Comm: syz-executor.4 Not tainted
6.2.0-rc5-00010-g41c66f470616 #8
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014

-- 
Thanks and Regards,

Dipanjan

Attachment: repro.syz
Description: Binary data

// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE 

#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/mount.h>
#include <sys/prctl.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

#ifndef __NR_pwritev2
#define __NR_pwritev2 328
#endif

static unsigned long long procid;

static void sleep_ms(uint64_t ms)
{
	usleep(ms * 1000);
}

static uint64_t current_time_ms(void)
{
	struct timespec ts;
	if (clock_gettime(CLOCK_MONOTONIC, &ts))
	exit(1);
	return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}

static void use_temporary_dir(void)
{
	char tmpdir_template[] = "./syzkaller.XXXXXX";
	char* tmpdir = mkdtemp(tmpdir_template);
	if (!tmpdir)
	exit(1);
	if (chmod(tmpdir, 0777))
	exit(1);
	if (chdir(tmpdir))
	exit(1);
}

static bool write_file(const char* file, const char* what, ...)
{
	char buf[1024];
	va_list args;
	va_start(args, what);
	vsnprintf(buf, sizeof(buf), what, args);
	va_end(args);
	buf[sizeof(buf) - 1] = 0;
	int len = strlen(buf);
	int fd = open(file, O_WRONLY | O_CLOEXEC);
	if (fd == -1)
		return false;
	if (write(fd, buf, len) != len) {
		int err = errno;
		close(fd);
		errno = err;
		return false;
	}
	close(fd);
	return true;
}

#define FS_IOC_SETFLAGS _IOW('f', 2, long)
static void remove_dir(const char* dir)
{
	int iter = 0;
	DIR* dp = 0;
retry:
		while (umount2(dir, MNT_DETACH | UMOUNT_NOFOLLOW) == 0) {
		}
	dp = opendir(dir);
	if (dp == NULL) {
		if (errno == EMFILE) {
	exit(1);
		}
	exit(1);
	}
	struct dirent* ep = 0;
	while ((ep = readdir(dp))) {
		if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
			continue;
		char filename[FILENAME_MAX];
		snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
			while (umount2(filename, MNT_DETACH | UMOUNT_NOFOLLOW) == 0) {
			}
		struct stat st;
		if (lstat(filename, &st))
	exit(1);
		if (S_ISDIR(st.st_mode)) {
			remove_dir(filename);
			continue;
		}
		int i;
		for (i = 0;; i++) {
			if (unlink(filename) == 0)
				break;
			if (errno == EPERM) {
				int fd = open(filename, O_RDONLY);
				if (fd != -1) {
					long flags = 0;
					if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0) {
					}
					close(fd);
					continue;
				}
			}
			if (errno == EROFS) {
				break;
			}
			if (errno != EBUSY || i > 100)
	exit(1);
				if (umount2(filename, MNT_DETACH | UMOUNT_NOFOLLOW))
	exit(1);
		}
	}
	closedir(dp);
	for (int i = 0;; i++) {
		if (rmdir(dir) == 0)
			break;
		if (i < 100) {
			if (errno == EPERM) {
				int fd = open(dir, O_RDONLY);
				if (fd != -1) {
					long flags = 0;
					if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0) {
					}
					close(fd);
					continue;
				}
			}
			if (errno == EROFS) {
				break;
			}
			if (errno == EBUSY) {
					if (umount2(dir, MNT_DETACH | UMOUNT_NOFOLLOW))
	exit(1);
				continue;
			}
			if (errno == ENOTEMPTY) {
				if (iter < 100) {
					iter++;
					goto retry;
				}
			}
		}
	exit(1);
	}
}

static void kill_and_wait(int pid, int* status)
{
	kill(-pid, SIGKILL);
	kill(pid, SIGKILL);
	for (int i = 0; i < 100; i++) {
		if (waitpid(-1, status, WNOHANG | __WALL) == pid)
			return;
		usleep(1000);
	}
	DIR* dir = opendir("/sys/fs/fuse/connections");
	if (dir) {
		for (;;) {
			struct dirent* ent = readdir(dir);
			if (!ent)
				break;
			if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
				continue;
			char abort[300];
			snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name);
			int fd = open(abort, O_WRONLY);
			if (fd == -1) {
				continue;
			}
			if (write(fd, abort, 1) < 0) {
			}
			close(fd);
		}
		closedir(dir);
	} else {
	}
	while (waitpid(-1, status, __WALL) != pid) {
	}
}

static void setup_test()
{
	prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
	setpgrp();
	write_file("/proc/self/oom_score_adj", "1000");
	if (symlink("/dev/binderfs", "./binderfs")) {
	}
}

static void execute_one(void);

#define WAIT_FLAGS __WALL

static void loop(void)
{
	int iter = 0;
	for (;; iter++) {
		char cwdbuf[32];
		sprintf(cwdbuf, "./%d", iter);
		if (mkdir(cwdbuf, 0777))
	exit(1);
		int pid = fork();
		if (pid < 0)
	exit(1);
		if (pid == 0) {
			if (chdir(cwdbuf))
	exit(1);
			setup_test();
			execute_one();
			exit(0);
		}
		int status = 0;
		uint64_t start = current_time_ms();
		for (;;) {
			if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
				break;
			sleep_ms(1);
			if (current_time_ms() - start < 5000)
				continue;
			kill_and_wait(pid, &status);
			break;
		}
		remove_dir(cwdbuf);
	}
}

uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};

void execute_one(void)
{
		intptr_t res = 0;
memcpy((void*)0x20000000, "./file0\000", 8);
	res = syscall(__NR_creat, 0x20000000ul, 0ul);
	if (res != -1)
		r[0] = res;
*(uint16_t*)0x20000080 = 0;
*(uint16_t*)0x20000082 = 0;
*(uint64_t*)0x20000088 = 0;
*(uint64_t*)0x20000090 = 8;
*(uint32_t*)0x20000098 = 0;
*(uint32_t*)0x2000009c = 0;
memset((void*)0x200000a0, 0, 16);
	syscall(__NR_ioctl, r[0], 0x40305828, 0x20000080ul);
*(uint64_t*)0x20001540 = 0x200000c0;
memcpy((void*)0x200000c0, "\x8a\xca\x4d\x28\x0c\x89\x8e\xd9\xa8\x97\x11\x07\xe9\x2b\xc6\x3c\xb6\x9c\x90\x0d\x2d\x20\xc8\x05\x45\x65\xa2\x9e\x83\xb0\x1b\xa5\x0f\x5b\xdd\xab\x9b\x11\x85\xc4\x1b\x88\xb8\x40\xe1\x02\x50\x9f\x96\x42\xa8\x1f\xb4\xa5\x45\x45\x48\xb9\x58\x06\x35\xe0\x13\xd2\x92\xb4\xc1\x78\xc3\x1a\x00\x4d\xd0\x68\xed\xa2\x20\x04\x14\x30\x81\x00\x8e\x7a\x8e\xc0\xbd\xf9\x57\x23\x1d\x63\x14\x5b\x14\xb8\x79\xe4\x2f\x63\xad\x75\xd3\xc0\x9f\x72", 106);
*(uint64_t*)0x20001548 = 0x6a;
*(uint64_t*)0x20001550 = 0;
*(uint64_t*)0x20001558 = 0;
*(uint64_t*)0x20001560 = 0;
*(uint64_t*)0x20001568 = 0;
*(uint64_t*)0x20001570 = 0;
*(uint64_t*)0x20001578 = 0;
*(uint64_t*)0x20001580 = 0;
*(uint64_t*)0x20001588 = 0;
	syscall(__NR_pwritev2, r[0], 0x20001540ul, 5ul, 0x502, 9, 2ul);
memcpy((void*)0x20000000, "./file0\000", 8);
	res = syscall(__NR_creat, 0x20000000ul, 0ul);
	if (res != -1)
		r[1] = res;
*(uint16_t*)0x20000080 = 0;
*(uint16_t*)0x20000082 = 2;
*(uint64_t*)0x20000088 = 0;
*(uint64_t*)0x20000090 = 0x1ffe00000;
*(uint32_t*)0x20000098 = 0;
*(uint32_t*)0x2000009c = 0;
memset((void*)0x200000a0, 0, 16);
	syscall(__NR_ioctl, r[1], 0x40305828, 0x20000080ul);

}
int main(void)
{
		syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
	syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul);
	syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
	for (procid = 0; procid < 8; procid++) {
		if (fork() == 0) {
			use_temporary_dir();
			loop();
		}
	}
	sleep(1000000);
	return 0;
}