syzbot


KMSAN: kernel-infoleak in __skb_datagram_iter (4)

Status: upstream: reported on 2024/05/24 12:51
Subsystems: net
[Documentation on labels]
Reported-by: syzbot+0c85cae3350b7d486aee@syzkaller.appspotmail.com
First crash: 118d, last: 22d
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [net?] KMSAN: kernel-infoleak in __skb_datagram_iter (4) 0 (1) 2024/05/24 12:51
Similar bugs (6)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: kernel-infoleak in __skb_datagram_iter (2) net C 126 178d 230d 25/28 fixed on 2024/03/25 23:45
upstream KMSAN: kernel-infoleak in copyout (2) net C 6723 469d 1637d 22/28 fixed on 2023/06/08 14:41
upstream KMSAN: kernel-infoleak in __skb_datagram_iter (3) net C 25 122d 176d 25/28 fixed on 2024/05/23 00:06
upstream KMSAN: kernel-infoleak in __skb_datagram_iter net 68 359d 464d 23/28 fixed on 2023/09/28 17:51
android-5-15 KASAN: use-after-free Read in __skb_datagram_iter origin:upstream C done 1 280d 311d 0/2 auto-obsoleted due to no activity on 2024/03/22 20:57
upstream KASAN: use-after-free Read in __skb_datagram_iter net 431 1234d 1241d 0/28 auto-closed as invalid on 2021/07/03 04:24

Sample crash report:
=====================================================
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
BUG: KMSAN: kernel-infoleak in copy_to_user_iter lib/iov_iter.c:24 [inline]
BUG: KMSAN: kernel-infoleak in iterate_ubuf include/linux/iov_iter.h:29 [inline]
BUG: KMSAN: kernel-infoleak in iterate_and_advance2 include/linux/iov_iter.h:245 [inline]
BUG: KMSAN: kernel-infoleak in iterate_and_advance include/linux/iov_iter.h:271 [inline]
BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x366/0x24a0 lib/iov_iter.c:185
 instrument_copy_to_user include/linux/instrumented.h:114 [inline]
 copy_to_user_iter lib/iov_iter.c:24 [inline]
 iterate_ubuf include/linux/iov_iter.h:29 [inline]
 iterate_and_advance2 include/linux/iov_iter.h:245 [inline]
 iterate_and_advance include/linux/iov_iter.h:271 [inline]
 _copy_to_iter+0x366/0x24a0 lib/iov_iter.c:185
 copy_to_iter include/linux/uio.h:196 [inline]
 simple_copy_to_iter net/core/datagram.c:521 [inline]
 __skb_datagram_iter+0x17e/0x1070 net/core/datagram.c:401
 skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:535
 skb_copy_datagram_msg include/linux/skbuff.h:4020 [inline]
 packet_recvmsg+0xdc4/0x2500 net/packet/af_packet.c:3540
 sock_recvmsg_nosec net/socket.c:1046 [inline]
 sock_recvmsg+0x2c4/0x340 net/socket.c:1068
 sock_read_iter+0x333/0x3c0 net/socket.c:1138
 new_sync_read fs/read_write.c:395 [inline]
 vfs_read+0x8c0/0xf60 fs/read_write.c:476
 ksys_read+0x20f/0x4c0 fs/read_write.c:619
 __do_sys_read fs/read_write.c:629 [inline]
 __se_sys_read fs/read_write.c:627 [inline]
 __x64_sys_read+0x93/0xe0 fs/read_write.c:627
 x64_sys_call+0x3055/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
 slab_post_alloc_hook mm/slub.c:3994 [inline]
 slab_alloc_node mm/slub.c:4037 [inline]
 kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4080
 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:583
 __alloc_skb+0x363/0x7b0 net/core/skbuff.c:674
 alloc_skb_fclone include/linux/skbuff.h:1370 [inline]
 tipc_buf_acquire+0x4c/0x230 net/tipc/msg.c:72
 tipc_disc_create+0x134/0x820 net/tipc/discover.c:359
 tipc_enable_bearer net/tipc/bearer.c:344 [inline]
 __tipc_nl_bearer_enable+0x184c/0x22c0 net/tipc/bearer.c:1043
 tipc_nl_bearer_enable+0x3c/0x70 net/tipc/bearer.c:1052
 genl_family_rcv_msg_doit net/netlink/genetlink.c:1115 [inline]
 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
 genl_rcv_msg+0x1214/0x12c0 net/netlink/genetlink.c:1210
 netlink_rcv_skb+0x375/0x650 net/netlink/af_netlink.c:2550
 genl_rcv+0x40/0x60 net/netlink/genetlink.c:1219
 netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline]
 netlink_unicast+0xf52/0x1260 net/netlink/af_netlink.c:1357
 netlink_sendmsg+0x10da/0x11e0 net/netlink/af_netlink.c:1901
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg+0x30f/0x380 net/socket.c:745
 ____sys_sendmsg+0x877/0xb60 net/socket.c:2597
 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2651
 __sys_sendmsg net/socket.c:2680 [inline]
 __do_sys_sendmsg net/socket.c:2689 [inline]
 __se_sys_sendmsg net/socket.c:2687 [inline]
 __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2687
 x64_sys_call+0x2da0/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:47
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Bytes 4-5 of 108 are uninitialized
Memory access of size 108 starts at ffff88811a050fa4
Data copied to user address 0000000020000180

CPU: 1 UID: 0 PID: 11445 Comm: syz.3.2574 Not tainted 6.11.0-rc5-syzkaller-00015-g3e9bff3bbe13 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
=====================================================

Crashes (52):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/08/27 17:23 upstream 3e9bff3bbe13 6c853ff9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/07/25 09:06 upstream c33ffdb70cc6 b24754ac .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/08/24 20:53 upstream d2bafcf224f3 d7d32352 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/08/11 07:24 upstream 7299cd48aece 6f4edef4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/08/11 04:49 upstream 7299cd48aece 6f4edef4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/08/07 06:22 upstream eb5e56d14912 e1bdb00a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/08/03 05:59 upstream 948752d2e010 53683cf2 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/08/03 05:58 upstream 948752d2e010 53683cf2 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/08/03 05:26 upstream 948752d2e010 53683cf2 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/08/03 05:26 upstream 948752d2e010 53683cf2 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/08/03 05:14 upstream 948752d2e010 53683cf2 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/07/31 07:30 upstream 22f546873149 6fde257d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/07/28 15:12 upstream 6342649c33d2 46eb10b7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/07/28 15:12 upstream 6342649c33d2 46eb10b7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/07/28 15:08 upstream 6342649c33d2 46eb10b7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/07/28 15:07 upstream 6342649c33d2 46eb10b7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/07/23 18:41 upstream 66ebbdfdeb09 708c10c4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/07/23 18:41 upstream 66ebbdfdeb09 708c10c4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/06/12 18:54 upstream 101b7a97143a 4d75f4f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/06/12 18:53 upstream 101b7a97143a 4d75f4f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/06/12 09:00 upstream 101b7a97143a 4d75f4f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/06/12 09:00 upstream 101b7a97143a 4d75f4f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/06/12 09:00 upstream 101b7a97143a 4d75f4f7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/06/12 00:16 upstream 101b7a97143a c7d7d815 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/06/12 00:15 upstream 101b7a97143a c7d7d815 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/06/08 15:34 upstream 101b7a97143a 82c05ab8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/06/08 15:33 upstream 101b7a97143a 82c05ab8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/06/08 15:33 upstream 101b7a97143a 82c05ab8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/06/06 16:37 upstream 101b7a97143a 121701b6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/06/06 16:36 upstream 101b7a97143a 121701b6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/06/06 08:05 upstream 101b7a97143a 121701b6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/06/05 12:58 upstream 101b7a97143a e1e2c66e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/06/05 12:58 upstream 101b7a97143a e1e2c66e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/06/05 11:41 upstream 101b7a97143a e1e2c66e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/06/05 11:41 upstream 101b7a97143a e1e2c66e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/06/05 11:21 upstream 101b7a97143a e1e2c66e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/06/05 11:21 upstream 101b7a97143a e1e2c66e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/05/26 06:47 upstream 101b7a97143a a10a183e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/05/26 06:45 upstream 101b7a97143a a10a183e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/05/25 14:20 upstream 101b7a97143a a10a183e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/05/25 14:20 upstream 101b7a97143a a10a183e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/05/25 14:13 upstream 101b7a97143a a10a183e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/05/25 14:13 upstream 101b7a97143a a10a183e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/05/24 04:59 upstream 101b7a97143a 8f98448e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
2024/05/24 04:59 upstream 101b7a97143a 8f98448e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in __skb_datagram_iter
* Struck through repros no longer work on HEAD.