Re: [syzbot] [io-uring?] KMSAN: uninit-value in io_sendrecv_fail

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

w interface driver emi26 - firmware loader
[    4.930123][    T1] usbcore: registered new interface driver emi62 - firmware loader
[    4.933583][    T1] usbcore: registered new interface driver idmouse
[    4.936138][    T1] usbcore: registered new interface driver iowarrior
[    4.938260][    T1] usbcore: registered new interface driver isight_firmware
[    4.941539][    T1] usbcore: registered new interface driver usblcd
[    4.944208][    T1] usbcore: registered new interface driver ldusb
[    4.946236][    T1] usbcore: registered new interface driver legousbtower
[    4.948760][    T1] usbcore: registered new interface driver usbtest
[    4.951336][    T1] usbcore: registered new interface driver usb_ehset_test
[    4.953754][    T1] usbcore: registered new interface driver trancevibrator
[    4.956657][    T1] usbcore: registered new interface driver uss720
[    4.958553][    T1] uss720: USB Parport Cable driver for Cables using the Lucent Technologies USS720 Chip
[    4.961696][    T1] uss720: NOTE: this is a special purpose driver to allow nonstandard
[    4.965815][    T1] uss720: protocols (eg. bitbang) over USS720 usb to parallel cables
[    4.968828][    T1] uss720: If you just want to connect to a printer, use usblp instead
[    4.971404][    T1] usbcore: registered new interface driver usbsevseg
[    4.973400][    T1] usbcore: registered new interface driver yurex
[    4.975425][    T1] usbcore: registered new interface driver chaoskey
[    4.977627][    T1] usbcore: registered new interface driver sisusb
[    4.979915][    T1] usbcore: registered new interface driver lvs
[    4.981851][    T1] usbcore: registered new interface driver cxacru
[    4.983985][    T1] usbcore: registered new interface driver speedtch
[    4.985950][    T1] usbcore: registered new interface driver ueagle-atm
[    4.988079][    T1] xusbatm: malformed module parameters
[    4.990267][    T1] dummy_hcd dummy_hcd.0: USB Host+Gadget Emulator, driver 02 May 2005
[    4.992631][    T1] dummy_hcd dummy_hcd.0: Dummy host controller
[    4.994246][    T1] dummy_hcd dummy_hcd.0: new USB bus registered, assigned bus number 1
[    4.996646][    T1] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 6.00
[    4.999972][    T1] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[    5.002339][    T1] usb usb1: Product: Dummy host controller
[    5.004170][    T1] usb usb1: Manufacturer: Linux 6.0.0-rc1-syzkaller-00033-gd59bd748db0a dummy_hcd
[    5.006694][    T1] usb usb1: SerialNumber: dummy_hcd.0
[    5.008294][    T1] hub 1-0:1.0: USB hub found
[    5.009512][    T1] hub 1-0:1.0: 1 port detected
[    5.011319][    T1] dummy_hcd dummy_hcd.1: USB Host+Gadget Emulator, driver 02 May 2005
[    5.013887][    T1] dummy_hcd dummy_hcd.1: Dummy host controller
[    5.016176][    T1] dummy_hcd dummy_hcd.1: new USB bus registered, assigned bus number 2
[    5.018574][    T1] usb usb2: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 6.00
[    5.020979][    T1] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[    5.022687][    T1] usb usb2: Product: Dummy host controller
[    5.024450][    T1] usb usb2: Manufacturer: Linux 6.0.0-rc1-syzkaller-00033-gd59bd748db0a dummy_hcd
[    5.027608][    T1] usb usb2: SerialNumber: dummy_hcd.1
[    5.029702][    T1] hub 2-0:1.0: USB hub found
[    5.031266][    T1] hub 2-0:1.0: 1 port detected
[    5.032936][    T1] dummy_hcd dummy_hcd.2: USB Host+Gadget Emulator, driver 02 May 2005
[    5.035475][    T1] dummy_hcd dummy_hcd.2: Dummy host controller
[    5.037713][    T1] dummy_hcd dummy_hcd.2: new USB bus registered, assigned bus number 3
[    5.040503][    T1] usb usb3: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 6.00
[    5.043261][    T1] usb usb3: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[    5.045104][    T1] usb usb3: Product: Dummy host controller
[    5.046289][    T1] usb usb3: Manufacturer: Linux 6.0.0-rc1-syzkaller-00033-gd59bd748db0a dummy_hcd
[    5.048827][    T1] usb usb3: SerialNumber: dummy_hcd.2
[    5.050576][    T1] hub 3-0:1.0: USB hub found
[    5.051876][    T1] hub 3-0:1.0: 1 port detected
[    5.053553][    T1] dummy_hcd dummy_hcd.3: USB Host+Gadget Emulator, driver 02 May 2005
[    5.055781][    T1] dummy_hcd dummy_hcd.3: Dummy host controller
[    5.057706][    T1] dummy_hcd dummy_hcd.3: new USB bus registered, assigned bus number 4
[    5.060296][    T1] usb usb4: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 6.00
[    5.062797][    T1] usb usb4: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[    5.064685][    T1] usb usb4: Product: Dummy host controller
[    5.066160][    T1] usb usb4: Manufacturer: Linux 6.0.0-rc1-syzkaller-00033-gd59bd748db0a dummy_hcd
[    5.068499][    T1] usb usb4: SerialNumber: dummy_hcd.3
[    5.070209][    T1] hub 4-0:1.0: USB hub found
[    5.071787][    T1] hub 4-0:1.0: 1 port detected
[    5.073440][    T1] dummy_hcd dummy_hcd.4: USB Host+Gadget Emulator, driver 02 May 2005
[    5.075182][    T1] dummy_hcd dummy_hcd.4: Dummy host controller
[    5.076592][    T1] dummy_hcd dummy_hcd.4: new USB bus registered, assigned bus number 5
[    5.078624][    T1] usb usb5: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 6.00
[    5.080862][    T1] usb usb5: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[    5.083013][    T1] usb usb5: Product: Dummy host controller
[    5.084611][    T1] usb usb5: Manufacturer: Linux 6.0.0-rc1-syzkaller-00033-gd59bd748db0a dummy_hcd
[    5.087050][    T1] usb usb5: SerialNumber: dummy_hcd.4
[    5.088518][    T1] hub 5-0:1.0: USB hub found
[    5.089972][    T1] hub 5-0:1.0: 1 port detected
[    5.091603][    T1] dummy_hcd dummy_hcd.5: USB Host+Gadget Emulator, driver 02 May 2005
[    5.094464][    T1] dummy_hcd dummy_hcd.5: Dummy host controller
[    5.096179][    T1] dummy_hcd dummy_hcd.5: new USB bus registered, assigned bus number 6
[    5.098245][    T1] usb usb6: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 6.00
[    5.100696][    T1] usb usb6: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[    5.102751][    T1] usb usb6: Product: Dummy host controller
[    5.104243][    T1] usb usb6: Manufacturer: Linux 6.0.0-rc1-syzkaller-00033-gd59bd748db0a dummy_hcd
[    5.106248][    T1] usb usb6: SerialNumber: dummy_hcd.5
[    5.107854][    T1] hub 6-0:1.0: USB hub found
[    5.109089][    T1] hub 6-0:1.0: 1 port detected
[    5.110733][    T1] dummy_hcd dummy_hcd.6: USB Host+Gadget Emulator, driver 02 May 2005
[    5.112657][    T1] dummy_hcd dummy_hcd.6: Dummy host controller
[    5.113957][    T1] dummy_hcd dummy_hcd.6: new USB bus registered, assigned bus number 7
[    5.115878][    T1] usb usb7: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 6.00
[    5.117770][    T1] usb usb7: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[    5.119911][    T1] usb usb7: Product: Dummy host controller
[    5.121564][    T1] usb usb7: Manufacturer: Linux 6.0.0-rc1-syzkaller-00033-gd59bd748db0a dummy_hcd
[    5.123794][    T1] usb usb7: SerialNumber: dummy_hcd.6
[    5.125643][    T1] hub 7-0:1.0: USB hub found
[    5.128371][    T1] hub 7-0:1.0: 1 port detected
[    5.130464][    T1] dummy_hcd dummy_hcd.7: USB Host+Gadget Emulator, driver 02 May 2005
[    5.132874][    T1] dummy_hcd dummy_hcd.7: Dummy host controller
[    5.134563][    T1] dummy_hcd dummy_hcd.7: new USB bus registered, assigned bus number 8
[    5.136921][    T1] usb usb8: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 6.00
[    5.139796][    T1] usb usb8: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[    5.142568][    T1] usb usb8: Product: Dummy host controller
[    5.144170][    T1] usb usb8: Manufacturer: Linux 6.0.0-rc1-syzkaller-00033-gd59bd748db0a dummy_hcd
[    5.146630][    T1] usb usb8: SerialNumber: dummy_hcd.7
[    5.148441][    T1] hub 8-0:1.0: USB hub found
[    5.150215][    T1] hub 8-0:1.0: 1 port detected
[    5.153433][    T1] general protection fault, probably for non-canonical address 0xffff000000000800: 0000 [#1] PREEMPT SMP
[    5.157506][    T1] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.0.0-rc1-syzkaller-00033-gd59bd748db0a #0
[    5.159433][    T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
[    5.160818][    T1] RIP: 0010:kmem_cache_alloc_trace+0x6a/0x1e0
[    5.161856][    T1] Code: 48 85 c0 74 7e 49 89 c7 49 8b 07 65 48 03 05 4d 31 af 7e 48 8b 50 08 48 8b 38 48 85 ff 74 7d 48 83 78 10 00 74 76 41 8b 47 28 <48> 8b 1c 07 48 8d 4a 08 4d 8b 07 48 89 f8 65 49 0f c7 08 0f 94 c0
[    5.162052][    T1] RSP: 0000:ffff8881001af8a0 EFLAGS: 00010286
[    5.162052][    T1] RAX: 0000000000000800 RBX: 0000000000000000 RCX: 0000000000000000
[    5.162052][    T1] RDX: 0000000000009e48 RSI: 0000000000000dc0 RDI: ffff000000000000
[    5.162052][    T1] RBP: ffff8881001af8e0 R08: 0000000000000dc0 R09: ffffffff82992c5d
[    5.162052][    T1] R10: 0000000000000004 R11: ffff8881001e8000 R12: ffff888100041d00
[    5.162052][    T1] R13: ffffffff823e1d01 R14: 0000000000000dc0 R15: ffff888100041d00
[    5.162052][    T1] FS:  0000000000000000(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000
[    5.162052][    T1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    5.162052][    T1] CR2: ffff88823ffff000 CR3: 0000000005c29000 CR4: 00000000003506f0
[    5.162052][    T1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[    5.162052][    T1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[    5.162052][    T1] Call Trace:
[    5.162052][    T1]  <TASK>
[    5.162052][    T1]  kobject_uevent_env+0x151/0x4c0
[    5.162052][    T1]  ? device_links_driver_bound+0x596/0x5b0
[    5.162052][    T1]  kobject_uevent+0x23/0x30
[    5.162052][    T1]  driver_bound+0x1da/0x200
[    5.162052][    T1]  ? platform_uevent+0x90/0x90
[    5.162052][    T1]  really_probe+0x424/0x4c0
[    5.162052][    T1]  ? __driver_probe_device+0xeb/0x140
[    5.162052][    T1]  __driver_probe_device+0xf6/0x140
[    5.162052][    T1]  driver_probe_device+0x31/0x210
[    5.162052][    T1]  __device_attach_driver+0x1e1/0x250
[    5.162052][    T1]  ? coredump_store+0x50/0x50
[    5.162052][    T1]  bus_for_each_drv+0xae/0x100
[    5.162052][    T1]  __device_attach+0x13d/0x220
[    5.162052][    T1]  device_initial_probe+0x1e/0x30
[    5.162052][    T1]  bus_probe_device+0x62/0xf0
[    5.162052][    T1]  device_add+0x655/0x7b0
[    5.162052][    T1]  platform_device_add+0x22f/0x330
[    5.162052][    T1]  dummy_hcd_init+0x4ce/0x6dc
[    5.162052][    T1]  ? configfs_register_subsystem+0x228/0x240
[    5.162052][    T1]  ? usb_udc_init+0x9d/0x9d
[    5.162052][    T1]  do_one_initcall+0xa8/0x390
[    5.162052][    T1]  ? skip_spaces+0x2c/0x40
[    5.162052][    T1]  ? next_arg+0x266/0x280
[    5.162052][    T1]  ? parse_args+0x577/0x5b0
[    5.162052][    T1]  do_initcall_level+0x94/0x171
[    5.162052][    T1]  do_initcalls+0x4e/0x89
[    5.162052][    T1]  do_basic_setup+0x1d/0x1f
[    5.200701][    T1]  kernel_init_freeable+0x113/0x189
[    5.200701][    T1]  ? rest_init+0xd0/0xd0
[    5.200701][    T1]  kernel_init+0x1f/0x2a0
[    5.200701][    T1]  ? rest_init+0xd0/0xd0
[    5.200701][    T1]  ret_from_fork+0x1f/0x30
[    5.200701][    T1]  </TASK>
[    5.200701][    T1] Modules linked in:
[    5.210897][    C0] vkms_vblank_simulate: vblank timer overrun
[    5.212396][    T1] ---[ end trace 0000000000000000 ]---
[    5.213702][    T1] RIP: 0010:kmem_cache_alloc_trace+0x6a/0x1e0
[    5.215084][    T1] Code: 48 85 c0 74 7e 49 89 c7 49 8b 07 65 48 03 05 4d 31 af 7e 48 8b 50 08 48 8b 38 48 85 ff 74 7d 48 83 78 10 00 74 76 41 8b 47 28 <48> 8b 1c 07 48 8d 4a 08 4d 8b 07 48 89 f8 65 49 0f c7 08 0f 94 c0
[    5.220767][    T1] RSP: 0000:ffff8881001af8a0 EFLAGS: 00010286
[    5.222164][    T1] RAX: 0000000000000800 RBX: 0000000000000000 RCX: 0000000000000000
[    5.224220][    T1] RDX: 0000000000009e48 RSI: 0000000000000dc0 RDI: ffff000000000000
[    5.226644][    T1] RBP: ffff8881001af8e0 R08: 0000000000000dc0 R09: ffffffff82992c5d
[    5.229009][    T1] R10: 0000000000000004 R11: ffff8881001e8000 R12: ffff888100041d00
[    5.231225][    T1] R13: ffffffff823e1d01 R14: 0000000000000dc0 R15: ffff888100041d00
[    5.233220][    T1] FS:  0000000000000000(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000
[    5.235486][    T1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    5.237106][    T1] CR2: ffff88823ffff000 CR3: 0000000005c29000 CR4: 00000000003506f0
[    5.238923][    T1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[    5.240518][    T1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[    5.242066][    T1] Kernel panic - not syncing: Fatal exception
[    5.244082][    T1] Kernel Offset: disabled
[    5.245268][    T1] Rebooting in 86400 seconds..


syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.21.4'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3912001592=/tmp/go-build -gno-record-gcc-switches'

git status (err=<nil>)
HEAD detached at 6ee49f2e6
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=6ee49f2e61b06b3d64c676dd2232a5ac362902a6 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240308-214706'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=6ee49f2e61b06b3d64c676dd2232a5ac362902a6 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240308-214706'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=6ee49f2e61b06b3d64c676dd2232a5ac362902a6 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240308-214706'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-stress github.com/google/syzkaller/tools/syz-stress
mkdir -p ./bin/linux_amd64
gcc -o ./bin/linux_amd64/syz-executor executor/executor.cc \
	-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"6ee49f2e61b06b3d64c676dd2232a5ac362902a6\"


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=146d8aa5180000


Tested on:

commit:         d59bd748 io_uring/poll: disable level triggered poll
git tree:       git://git.kernel.dk/linux.git io_uring-6.0
kernel config:  https://syzkaller.appspot.com/x/.config?x=7646c61aacfb37b5
dashboard link: https://syzkaller.appspot.com/bug?extid=f8e9a371388aa62ecab4
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

Note: no patches were applied.