syzbot


KMSAN: uninit-value in bpf_prog_run_generic_xdp

Status: upstream: reported C repro on 2022/11/18 11:39
Subsystems: can
[Documentation on labels]
Reported-by: syzbot+0e6ddb1ef80986bdfe64@syzkaller.appspotmail.com
First crash: 902d, last: 3h13m
Discussions (9)
Title Replies (including bot) Last reply
[syzbot] KMSAN: uninit-value in bpf_prog_run_generic_xdp 0 (2) 2024/03/16 16:19
[syzbot] Monthly bpf report (Mar 2024) 0 (1) 2024/03/11 10:18
[syzbot] Monthly bpf report (Feb 2024) 0 (1) 2024/02/08 21:48
[syzbot] Monthly can report (Jan 2024) 0 (1) 2024/01/16 07:55
Re: [syzbot] KMSAN: uninit-value in bpf_prog_run_generic_xdp 1 (1) 2023/12/21 11:22
[syzbot] Monthly can report (Dec 2023) 0 (1) 2023/12/02 14:45
[syzbot] Monthly bpf report (Nov 2023) 0 (1) 2023/11/07 04:52
[syzbot] Monthly can report (Nov 2023) 0 (1) 2023/11/01 10:13
[syzbot] Monthly batman report (Oct 2023) 0 (1) 2023/10/09 09:23
Similar bugs (18)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in skb_release_data (3) net C 10 676d 1355d 0/26 auto-obsoleted due to no activity on 2022/11/17 07:20
upstream KMSAN: uninit-value in hsr_register_frame_in net C 197 309d 1931d 0/26 auto-obsoleted due to no activity on 2024/02/18 18:09
upstream KMSAN: kernel-infoleak in copyout (2) net C 6723 353d 1522d 22/26 fixed on 2023/06/08 14:41
upstream KMSAN: uninit-value in ipv6_find_tlv net C 271 394d 1748d 22/26 fixed on 2023/06/08 14:41
upstream KMSAN: uninit-value in ax25cmp (2) hams C 51 613d 874d 0/26 closed as invalid on 2022/11/18 11:50
upstream KMSAN: uninit-value in virtqueue_add (3) virt 13 570d 862d 0/26 auto-obsoleted due to no activity on 2023/02/12 03:53
upstream KMSAN: kernel-infoleak in _copy_to_iter (7) net C 138977 457d 809d 22/26 fixed on 2023/02/24 13:50
upstream KMSAN: kernel-infoleak in __skb_datagram_iter net 68 243d 348d 23/26 fixed on 2023/09/28 17:51
upstream KMSAN: uninit-value in can_send can C 630 552d 570d 22/26 fixed on 2023/02/24 13:50
upstream KMSAN: uninit-value in IP6_ECN_decapsulate net C 981 159d 2075d 25/26 fixed on 2023/12/21 03:45
upstream KMSAN: uninit-value in inet_frag_find (2) net 2 866d 874d 0/26 auto-closed as invalid on 2022/04/11 17:13
upstream KMSAN: kernel-infoleak in _copy_to_iter (6) net C 748 810d 899d 20/26 fixed on 2022/03/08 16:11
upstream KMSAN: uninit-value in eth_type_trans (2) net C 4738 2h05m 1586d 0/26 upstream: reported C repro on 2020/01/22 16:47
upstream KMSAN: uninit-value in hsr_fill_frame_info (2) net C 65 309d 592d 0/26 auto-obsoleted due to no activity on 2023/10/30 13:38
upstream KMSAN: uninit-value in erspan_build_header net 40 502d 592d 0/26 auto-obsoleted due to no activity on 2023/05/10 10:26
upstream KMSAN: uninit-value in ip_tunnel_xmit (3) net C 1516 598d 1285d 0/26 closed as invalid on 2022/10/12 18:48
upstream KMSAN: uninit-value in br_dev_xmit bridge C 537 497d 1553d 0/26 auto-obsoleted due to no activity on 2023/05/15 13:28
upstream KMSAN: uninit-value in batadv_get_vid batman C 1947 449d 1553d 0/26 auto-obsoleted due to no activity on 2023/07/23 05:56

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in bpf_prog_run_generic_xdp+0x13a0/0x1ee0 net/core/dev.c:4876
 bpf_prog_run_generic_xdp+0x13a0/0x1ee0 net/core/dev.c:4876
 netif_receive_generic_xdp net/core/dev.c:4958 [inline]
 do_xdp_generic+0xb68/0x1440 net/core/dev.c:5017
 __netif_receive_skb_core+0x2533/0x6190 net/core/dev.c:5358
 __netif_receive_skb_one_core net/core/dev.c:5536 [inline]
 __netif_receive_skb+0xca/0xa00 net/core/dev.c:5652
 process_backlog+0x480/0x8b0 net/core/dev.c:5981
 __napi_poll+0xe7/0x980 net/core/dev.c:6632
 napi_poll net/core/dev.c:6701 [inline]
 net_rx_action+0x89d/0x1820 net/core/dev.c:6813
 __do_softirq+0x1c0/0x7d7 kernel/softirq.c:554
 invoke_softirq kernel/softirq.c:428 [inline]
 __irq_exit_rcu kernel/softirq.c:633 [inline]
 irq_exit_rcu+0x6a/0x130 kernel/softirq.c:645
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
 sysvec_apic_timer_interrupt+0x83/0x90 arch/x86/kernel/apic/apic.c:1043
 asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:702
 __preempt_count_dec_and_test arch/x86/include/asm/preempt.h:94 [inline]
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
 _raw_spin_unlock_irqrestore+0x33/0x60 kernel/locking/spinlock.c:194
 unlock_hrtimer_base kernel/time/hrtimer.c:1021 [inline]
 hrtimer_start_range_ns+0x112c/0x11a0 kernel/time/hrtimer.c:1308
 hrtimer_start include/linux/hrtimer.h:275 [inline]
 j1939_tp_schedule_txtimer+0xc2/0x100 net/can/j1939/transport.c:702
 j1939_sk_send_loop net/can/j1939/socket.c:1164 [inline]
 j1939_sk_sendmsg+0x1a0e/0x2730 net/can/j1939/socket.c:1277
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg+0x30f/0x380 net/socket.c:745
 ____sys_sendmsg+0x877/0xb60 net/socket.c:2584
 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638
 __sys_sendmsg net/socket.c:2667 [inline]
 __do_sys_sendmsg net/socket.c:2676 [inline]
 __se_sys_sendmsg net/socket.c:2674 [inline]
 __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2674
 do_syscall_64+0xd5/0x1f0
 entry_SYSCALL_64_after_hwframe+0x6d/0x75

Uninit was stored to memory at:
 pskb_expand_head+0x30f/0x19d0 net/core/skbuff.c:2253
 netif_skb_check_for_xdp net/core/dev.c:4921 [inline]
 netif_receive_generic_xdp net/core/dev.c:4952 [inline]
 do_xdp_generic+0x931/0x1440 net/core/dev.c:5017
 __netif_receive_skb_core+0x2533/0x6190 net/core/dev.c:5358
 __netif_receive_skb_one_core net/core/dev.c:5536 [inline]
 __netif_receive_skb+0xca/0xa00 net/core/dev.c:5652
 process_backlog+0x480/0x8b0 net/core/dev.c:5981
 __napi_poll+0xe7/0x980 net/core/dev.c:6632
 napi_poll net/core/dev.c:6701 [inline]
 net_rx_action+0x89d/0x1820 net/core/dev.c:6813
 __do_softirq+0x1c0/0x7d7 kernel/softirq.c:554

Uninit was created at:
 slab_post_alloc_hook mm/slub.c:3804 [inline]
 slab_alloc_node mm/slub.c:3845 [inline]
 kmem_cache_alloc_node+0x613/0xc50 mm/slub.c:3888
 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577
 __alloc_skb+0x35b/0x7a0 net/core/skbuff.c:668
 alloc_skb include/linux/skbuff.h:1318 [inline]
 alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6504
 sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2795
 sock_alloc_send_skb include/net/sock.h:1835 [inline]
 j1939_sk_alloc_skb net/can/j1939/socket.c:878 [inline]
 j1939_sk_send_loop net/can/j1939/socket.c:1142 [inline]
 j1939_sk_sendmsg+0xc0a/0x2730 net/can/j1939/socket.c:1277
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg+0x30f/0x380 net/socket.c:745
 ____sys_sendmsg+0x877/0xb60 net/socket.c:2584
 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638
 __sys_sendmsg net/socket.c:2667 [inline]
 __do_sys_sendmsg net/socket.c:2676 [inline]
 __se_sys_sendmsg net/socket.c:2674 [inline]
 __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2674
 do_syscall_64+0xd5/0x1f0
 entry_SYSCALL_64_after_hwframe+0x6d/0x75

CPU: 0 PID: 5044 Comm: syz-executor640 Not tainted 6.8.0-syzkaller-11136-g66a27abac311 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
=====================================================

Crashes (504):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/03/16 16:19 upstream 66a27abac311 d615901c .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/26 18:57 upstream 614da38e2f7a a10a183e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/26 17:57 upstream 614da38e2f7a a10a183e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/25 12:58 upstream 614da38e2f7a a10a183e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/25 07:33 upstream 614da38e2f7a a10a183e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/24 01:04 upstream 614da38e2f7a 8f98448e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/23 06:23 upstream 614da38e2f7a 4d098039 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/23 01:30 upstream 614da38e2f7a 4d098039 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/21 23:45 upstream 614da38e2f7a 1014eca7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/21 02:13 upstream 614da38e2f7a c0f1611a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/20 12:36 upstream 614da38e2f7a c0f1611a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/19 16:32 upstream 614da38e2f7a c0f1611a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/18 15:58 upstream 614da38e2f7a c0f1611a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/17 19:32 upstream 614da38e2f7a a12e99e7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/17 07:55 upstream 614da38e2f7a c2e07261 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/17 06:34 upstream 614da38e2f7a c2e07261 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/16 11:25 upstream 614da38e2f7a ef5d53ed .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/15 23:51 upstream 614da38e2f7a 0b3dad46 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/15 22:25 upstream 614da38e2f7a 0b3dad46 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/15 21:11 upstream 614da38e2f7a 0b3dad46 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/15 12:35 upstream 614da38e2f7a fdb4c10c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/15 05:09 upstream 614da38e2f7a fdb4c10c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/14 06:44 upstream cd97950cbcab fdb4c10c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/14 00:52 upstream cd97950cbcab fdb4c10c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/13 12:38 upstream a38297e3fb01 9026e142 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/26 22:45 upstream 101b7a97143a a10a183e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/25 18:03 upstream 101b7a97143a a10a183e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/24 03:45 upstream 101b7a97143a 8f98448e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/23 11:04 upstream 101b7a97143a 4d098039 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/23 09:32 upstream 101b7a97143a 4d098039 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/23 08:37 upstream 101b7a97143a 4d098039 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/22 20:37 upstream 101b7a97143a 4d098039 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/22 04:22 upstream 101b7a97143a 1014eca7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/21 09:12 upstream 101b7a97143a c0f1611a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/21 06:51 upstream 101b7a97143a c0f1611a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/21 04:20 upstream 101b7a97143a c0f1611a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/19 22:56 upstream 101b7a97143a c0f1611a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/18 19:42 upstream 101b7a97143a c0f1611a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/18 00:30 upstream 101b7a97143a a12e99e7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/18 00:30 upstream 101b7a97143a a12e99e7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/16 18:40 upstream 101b7a97143a ef5d53ed .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/14 15:50 upstream a5131c3fdf26 fdb4c10c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/13 06:39 upstream ba16c1cf11c9 9026e142 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/13 04:34 upstream ba16c1cf11c9 9026e142 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2023/12/16 05:36 upstream 3bd7d7488169 3222d10c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386 KMSAN: uninit-value in bpf_prog_run_generic_xdp
2022/11/15 12:56 https://github.com/google/kmsan.git master cb231e2f67ec 97de9cfc .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386 KMSAN: uninit-value in bpf_prog_run_generic_xdp
2022/01/03 16:49 https://github.com/google/kmsan.git master 81c325bbf94e 4a3f34f2 .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in bpf_prog_run_generic_xdp
2021/12/06 12:45 https://github.com/google/kmsan.git master cdfb223e7e63 579a8754 .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in bpf_prog_run_generic_xdp
* Struck through repros no longer work on HEAD.