syzbot


KMSAN: uninit-value in __vxlan_find_mac (2)

Status: upstream: reported on 2025/04/08 14:28
Subsystems: net
[Documentation on labels]
Reported-by: syzbot+30db32094d453eb54941@syzkaller.appspotmail.com
First crash: 22d, last: 22d
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [net?] KMSAN: uninit-value in __vxlan_find_mac (2) 0 (1) 2025/04/08 14:28
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in __vxlan_find_mac net 1 166d 162d 0/28 auto-obsoleted due to no activity on 2025/02/18 10:28

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in __vxlan_find_mac+0x49a/0x4f0 drivers/net/vxlan/vxlan_core.c:-1
 __vxlan_find_mac+0x49a/0x4f0 drivers/net/vxlan/vxlan_core.c:-1
 vxlan_find_mac drivers/net/vxlan/vxlan_core.c:437 [inline]
 vxlan_xmit+0x174c/0x3e40 drivers/net/vxlan/vxlan_core.c:2785
 __netdev_start_xmit include/linux/netdevice.h:5201 [inline]
 netdev_start_xmit include/linux/netdevice.h:5210 [inline]
 xmit_one net/core/dev.c:3780 [inline]
 dev_hard_start_xmit+0x296/0xa40 net/core/dev.c:3796
 __dev_queue_xmit+0x3679/0x57e0 net/core/dev.c:4633
 dev_queue_xmit include/linux/netdevice.h:3350 [inline]
 __bpf_tx_skb net/core/filter.c:2135 [inline]
 __bpf_redirect_common net/core/filter.c:2179 [inline]
 __bpf_redirect+0x1514/0x1690 net/core/filter.c:2186
 ____bpf_clone_redirect net/core/filter.c:2460 [inline]
 bpf_clone_redirect+0x37f/0x500 net/core/filter.c:2430
 ___bpf_prog_run+0x12fd/0xf0b0 kernel/bpf/core.c:2018
 __bpf_prog_run512+0xc5/0xf0 kernel/bpf/core.c:2313
 bpf_dispatcher_nop_func include/linux/bpf.h:1316 [inline]
 __bpf_prog_run include/linux/filter.h:718 [inline]
 bpf_prog_run include/linux/filter.h:725 [inline]
 bpf_test_run+0x546/0xd20 net/bpf/test_run.c:434
 bpf_prog_test_run_skb+0x1906/0x25b0 net/bpf/test_run.c:1093
 bpf_prog_test_run+0x5e5/0xa30 kernel/bpf/syscall.c:4427
 __sys_bpf+0x6ce/0xdf0 kernel/bpf/syscall.c:5852
 __do_sys_bpf kernel/bpf/syscall.c:5941 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5939 [inline]
 __ia32_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5939
 ia32_sys_call+0x2126/0x41f0 arch/x86/include/generated/asm/syscalls_32.h:358
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
 __do_fast_syscall_32+0xb0/0x110 arch/x86/entry/syscall_32.c:306
 do_fast_syscall_32+0x38/0x80 arch/x86/entry/syscall_32.c:331
 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:369
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e

Uninit was created at:
 slab_post_alloc_hook mm/slub.c:4157 [inline]
 slab_alloc_node mm/slub.c:4200 [inline]
 kmem_cache_alloc_node_noprof+0x921/0xe10 mm/slub.c:4252
 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577
 pskb_expand_head+0x21f/0x1c10 net/core/skbuff.c:2247
 skb_ensure_writable+0x496/0x520 net/core/skbuff.c:6241
 __bpf_try_make_writable net/core/filter.c:1665 [inline]
 bpf_try_make_writable net/core/filter.c:1671 [inline]
 bpf_try_make_head_writable net/core/filter.c:1679 [inline]
 ____bpf_clone_redirect net/core/filter.c:2454 [inline]
 bpf_clone_redirect+0x1c5/0x500 net/core/filter.c:2430
 ___bpf_prog_run+0x12fd/0xf0b0 kernel/bpf/core.c:2018
 __bpf_prog_run512+0xc5/0xf0 kernel/bpf/core.c:2313
 bpf_dispatcher_nop_func include/linux/bpf.h:1316 [inline]
 __bpf_prog_run include/linux/filter.h:718 [inline]
 bpf_prog_run include/linux/filter.h:725 [inline]
 bpf_test_run+0x546/0xd20 net/bpf/test_run.c:434
 bpf_prog_test_run_skb+0x1906/0x25b0 net/bpf/test_run.c:1093
 bpf_prog_test_run+0x5e5/0xa30 kernel/bpf/syscall.c:4427
 __sys_bpf+0x6ce/0xdf0 kernel/bpf/syscall.c:5852
 __do_sys_bpf kernel/bpf/syscall.c:5941 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5939 [inline]
 __ia32_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5939
 ia32_sys_call+0x2126/0x41f0 arch/x86/include/generated/asm/syscalls_32.h:358
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
 __do_fast_syscall_32+0xb0/0x110 arch/x86/entry/syscall_32.c:306
 do_fast_syscall_32+0x38/0x80 arch/x86/entry/syscall_32.c:331
 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:369
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e

CPU: 0 UID: 0 PID: 9482 Comm: syz.5.941 Not tainted 6.14.0-syzkaller-12508-g92b71befc349 #0 PREEMPT(undef) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
=====================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/04/03 12:29 upstream 92b71befc349 996a9618 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in __vxlan_find_mac
* Struck through repros no longer work on HEAD.