syzbot


KMSAN: uninit-value in etf_enqueue_timesortedlist

Status: fixed on 2020/06/18 13:57
Subsystems: net
[Documentation on labels]
Fix commit: a1211bf9a777 sched: etf: do not assume all sockets are full blown
First crash: 1480d, last: 1473d

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in is_packet_valid net/sched/sch_etf.c:94 [inline]
BUG: KMSAN: uninit-value in etf_enqueue_timesortedlist+0x6cc/0x1060 net/sched/sch_etf.c:169
CPU: 1 PID: 13542 Comm: syz-executor.3 Not tainted 5.6.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c9/0x220 lib/dump_stack.c:118
 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118
 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215
 is_packet_valid net/sched/sch_etf.c:94 [inline]
 etf_enqueue_timesortedlist+0x6cc/0x1060 net/sched/sch_etf.c:169
 __dev_xmit_skb net/core/dev.c:3710 [inline]
 __dev_queue_xmit+0x1c00/0x3b20 net/core/dev.c:4021
 dev_queue_xmit+0x4b/0x60 net/core/dev.c:4085
 neigh_hh_output include/net/neighbour.h:499 [inline]
 neigh_output include/net/neighbour.h:508 [inline]
 ip6_finish_output2+0x2056/0x2640 net/ipv6/ip6_output.c:116
 __ip6_finish_output+0x824/0x8e0 net/ipv6/ip6_output.c:142
 ip6_finish_output+0x166/0x410 net/ipv6/ip6_output.c:152
 NF_HOOK_COND include/linux/netfilter.h:296 [inline]
 ip6_output+0x60a/0x770 net/ipv6/ip6_output.c:175
 dst_output include/net/dst.h:436 [inline]
 NF_HOOK include/linux/netfilter.h:307 [inline]
 ip6_xmit+0x1f67/0x2710 net/ipv6/ip6_output.c:279
 tcp_v6_send_synack+0xa7a/0xb90 net/ipv6/tcp_ipv6.c:521
 tcp_conn_request+0x48c0/0x4d10 net/ipv4/tcp_input.c:6719
 tcp_v6_conn_request+0x242/0x2d0 net/ipv6/tcp_ipv6.c:1151
 tcp_rcv_state_process+0x26b/0x71c0 net/ipv4/tcp_input.c:6190
 tcp_v6_do_rcv+0xed3/0x1d00 net/ipv6/tcp_ipv6.c:1463
 tcp_v6_rcv+0x3f59/0x4b40 net/ipv6/tcp_ipv6.c:1659
 ip6_protocol_deliver_rcu+0x13c3/0x22c0 net/ipv6/ip6_input.c:432
 ip6_input_finish net/ipv6/ip6_input.c:473 [inline]
 NF_HOOK include/linux/netfilter.h:307 [inline]
 ip6_input+0x2af/0x340 net/ipv6/ip6_input.c:482
 dst_input include/net/dst.h:442 [inline]
 ip6_rcv_finish net/ipv6/ip6_input.c:76 [inline]
 NF_HOOK include/linux/netfilter.h:307 [inline]
 ipv6_rcv+0x683/0x710 net/ipv6/ip6_input.c:306
 __netif_receive_skb_one_core net/core/dev.c:5187 [inline]
 __netif_receive_skb net/core/dev.c:5301 [inline]
 netif_receive_skb_internal net/core/dev.c:5391 [inline]
 netif_receive_skb+0x66b/0xf20 net/core/dev.c:5450
 tun_rx_batched include/linux/skbuff.h:4351 [inline]
 tun_get_user+0x6aef/0x6f60 drivers/net/tun.c:1997
 tun_chr_write_iter+0x1f2/0x360 drivers/net/tun.c:2026
 call_write_iter include/linux/fs.h:1902 [inline]
 new_sync_write fs/read_write.c:483 [inline]
 __vfs_write+0xa5a/0xca0 fs/read_write.c:496
 vfs_write+0x44a/0x8f0 fs/read_write.c:558
 ksys_write+0x267/0x450 fs/read_write.c:611
 __do_sys_write fs/read_write.c:623 [inline]
 __se_sys_write+0x92/0xb0 fs/read_write.c:620
 __x64_sys_write+0x4a/0x70 fs/read_write.c:620
 do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x416361
Code: 75 14 b8 01 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 c4 1b 00 00 c3 48 83 ec 08 e8 ca fc ff ff 48 89 04 24 b8 01 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 13 fd ff ff 48 89 d0 48 83 c4 08 48 3d 01
RSP: 002b:00007fd1302acc60 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000507b60 RCX: 0000000000416361
RDX: 000000000000008e RSI: 0000000020000080 RDI: 00000000000000f0
RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffffffffffff R11: 0000000000000293 R12: 00000000ffffffff
R13: 0000000000000bbe R14: 00000000004cde6b R15: 00007fd1302ad6d4

Uninit was created at:
 kmsan_save_stack_with_flags+0x3c/0x90 mm/kmsan/kmsan.c:144
 kmsan_internal_alloc_meta_for_pages mm/kmsan/kmsan_shadow.c:280 [inline]
 kmsan_alloc_page+0xb9/0x180 mm/kmsan/kmsan_shadow.c:304
 __alloc_pages_nodemask+0x5712/0x5e80 mm/page_alloc.c:4777
 alloc_pages_current+0x67d/0x990 mm/mempolicy.c:2211
 alloc_pages include/linux/gfp.h:532 [inline]
 alloc_slab_page+0x111/0x12f0 mm/slub.c:1530
 allocate_slab mm/slub.c:1675 [inline]
 new_slab+0x2bc/0x1130 mm/slub.c:1741
 new_slab_objects mm/slub.c:2490 [inline]
 ___slab_alloc+0x14a3/0x2040 mm/slub.c:2651
 __slab_alloc mm/slub.c:2691 [inline]
 slab_alloc_node mm/slub.c:2765 [inline]
 slab_alloc mm/slub.c:2810 [inline]
 kmem_cache_alloc+0xb23/0xd70 mm/slub.c:2815
 reqsk_alloc include/net/request_sock.h:84 [inline]
 inet_reqsk_alloc+0xac/0x830 net/ipv4/tcp_input.c:6493
 tcp_conn_request+0x753/0x4d10 net/ipv4/tcp_input.c:6619
 tcp_v6_conn_request+0x242/0x2d0 net/ipv6/tcp_ipv6.c:1151
 tcp_rcv_state_process+0x26b/0x71c0 net/ipv4/tcp_input.c:6190
 tcp_v6_do_rcv+0xed3/0x1d00 net/ipv6/tcp_ipv6.c:1463
 tcp_v6_rcv+0x3f59/0x4b40 net/ipv6/tcp_ipv6.c:1659
 ip6_protocol_deliver_rcu+0x13c3/0x22c0 net/ipv6/ip6_input.c:432
 ip6_input_finish net/ipv6/ip6_input.c:473 [inline]
 NF_HOOK include/linux/netfilter.h:307 [inline]
 ip6_input+0x2af/0x340 net/ipv6/ip6_input.c:482
 dst_input include/net/dst.h:442 [inline]
 ip6_rcv_finish net/ipv6/ip6_input.c:76 [inline]
 NF_HOOK include/linux/netfilter.h:307 [inline]
 ipv6_rcv+0x683/0x710 net/ipv6/ip6_input.c:306
 __netif_receive_skb_one_core net/core/dev.c:5187 [inline]
 __netif_receive_skb net/core/dev.c:5301 [inline]
 netif_receive_skb_internal net/core/dev.c:5391 [inline]
 netif_receive_skb+0x66b/0xf20 net/core/dev.c:5450
 tun_rx_batched include/linux/skbuff.h:4351 [inline]
 tun_get_user+0x6aef/0x6f60 drivers/net/tun.c:1997
 tun_chr_write_iter+0x1f2/0x360 drivers/net/tun.c:2026
 call_write_iter include/linux/fs.h:1902 [inline]
 new_sync_write fs/read_write.c:483 [inline]
 __vfs_write+0xa5a/0xca0 fs/read_write.c:496
 vfs_write+0x44a/0x8f0 fs/read_write.c:558
 ksys_write+0x267/0x450 fs/read_write.c:611
 __do_sys_write fs/read_write.c:623 [inline]
 __se_sys_write+0x92/0xb0 fs/read_write.c:620
 __x64_sys_write+0x4a/0x70 fs/read_write.c:620
 do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
=====================================================

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/05/08 08:46 https://github.com/google/kmsan.git master 21c44613a2fe 6c70a1c2 .config console log report ci-upstream-kmsan-gce
2020/05/02 12:24 https://github.com/google/kmsan.git master bfa90a4a3f3f 58da4c35 .config console log report ci-upstream-kmsan-gce
2020/05/01 00:27 https://github.com/google/kmsan.git master bfa90a4a3f3f 3698959a .config console log report ci-upstream-kmsan-gce
* Struck through repros no longer work on HEAD.