google / kmsan

KernelMemorySanitizer, a detector of uses of uninitialized memory in the Linux kernel
Other
406 stars 63 forks source link

duplicate frame for local var origin #75

Closed dvyukov closed 3 years ago

dvyukov commented 4 years ago

From a recent report: https://syzkaller.appspot.com/bug?extid=af962bf9e7e27bccd025

[  137.433919][T11659] Local variable ----offset@snapshot_compat_ioctl created at:
[  137.441372][T11659]  snapshot_compat_ioctl+0x324/0x650
[  137.446733][T11659]  snapshot_compat_ioctl+0x324/0x650

symbolized as:

Local variable ----offset@snapshot_compat_ioctl created at:
 get_current arch/x86/include/asm/current.h:15 [inline]
 snapshot_compat_ioctl+0x324/0x650 kernel/power/user.c:418
 get_current arch/x86/include/asm/current.h:15 [inline]
 snapshot_compat_ioctl+0x324/0x650 kernel/power/user.c:418

Why do we have 2 of the same frame? We should have frame and caller frame.

ramosian-glider commented 3 years ago

This should be fixed already, e.g. the latest report looks like:

[ 1741.094003][ T2831] ===================================================== [ 1741.100134][ T2831] BUG: KMSAN: uninit-value in string+0x3d2/0x700 [ 1741.100134][ T2831] string+0x3d2/0x700 [ 1741.100134][ T2831] vsnprintf+0x224f/0x36a0 [ 1741.100134][ T2831] scnprintf+0x23c/0x340 [ 1741.100134][ T2831] devkmsg_read+0x6d1/0x1160 [ 1741.100134][ T2831] vfs_read+0x6c8/0x1980 [ 1741.100134][ T2831] ksys_read+0x28c/0x520 [ 1741.100134][ T2831] x64_sys_read+0xdb/0x120 [ 1741.100134][ T2831] do_syscall_64+0x54/0xd0 [ 1741.139569][T28966] udc-core: couldn't find an available UDC or it's busy [ 1741.138118][ T2831] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1741.138118][ T2831] [ 1741.138118][ T2831] Local variable ----name@fsnotify_parent created at: [ 1741.138118][ T2831] __fsnotify_parent+0x235/0xfc0 [ 1741.138118][ T2831] fsnotify_perm+0x702/0xa80 [ 1741.138118][ T2831] =====================================================

We're using __builtin_return_address({0,1}) for these two frames, which are supposed to be different.