On 18. 12. 21 12:17, syzbot wrote:

Hello,

syzbot found the following issue on:

HEAD commit: 8b936c96768e kmsan: core: remove the accidentally committe.. git tree: https://github.com/google/kmsan.git master console output: https://syzkaller.appspot.com/x/log.txt?x=11791d89b00000 kernel config: https://syzkaller.appspot.com/x/.config?x=e00a8959fdd3f3e8 dashboard link: https://syzkaller.appspot.com/bug?extid=88412ee8811832b00dbe compiler: clang version 14.0.0 (git@github.com:llvm/llvm-project.git 0996585c8e3b3d409494eb5f1cad714b9e1f7fb5), GNU ld (GNU Binutils for Debian) 2.35.2 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13a7abf9b00000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=172410b9b00000

IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+88412ee8811832b00dbe@syzkaller.appspotmail.com

===================================================== BUG: KMSAN: uninit-value in snd_rawmidi_ioctl+0xf1e/0x1330 sound/core/rawmidi.c:887 snd_rawmidi_ioctl+0xf1e/0x1330 sound/core/rawmidi.c:887

Nice catch. I wonder why the problem was not detected by tests. The patch bellow should initialize the user_pversion variable:

diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c index 6f30231bdb88..befa9809ff00 100644 --- a/sound/core/rawmidi.c +++ b/sound/core/rawmidi.c @@ -447,6 +447,7 @@ static int snd_rawmidi_open(struct inode *inode, struct file *file) err = -ENOMEM; goto __error; } + rawmidi_file->user_pversion = 0; init_waitqueue_entry(&wait, current); add_wait_queue(&rmidi->open_wait, &wait); while (1) {

I'll send the path in the proper format ASAP.

Jaroslav