syzbot


KMSAN: uninit-value in mii_nway_restart (2)

Status: upstream: reported C repro on 2025/02/17 11:55
Subsystems: usb
[Documentation on labels]
Reported-by: syzbot+3361c2d6f78a3e0892f9@syzkaller.appspotmail.com
First crash: 6d16h, last: 10h40m
Discussions (2)
Title Replies (including bot) Last reply
[PATCH] net: fix uninitialised access in mii_nway_restart() 2 (2) 2025/02/18 01:10
[syzbot] [usb?] KMSAN: uninit-value in mii_nway_restart (2) 0 (2) 2025/02/17 20:59
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in mii_nway_restart usb C 2449 497d 2088d 25/28 fixed on 2023/12/21 03:45
Last patch testing requests (1)
Created Duration User Patch Repo Result
2025/02/17 20:59 58m qasdev00@gmail.com patch upstream OK log

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in mii_nway_restart+0x119/0x1e0 drivers/net/mii.c:468
 mii_nway_restart+0x119/0x1e0 drivers/net/mii.c:468
 ch9200_bind+0x238/0xeb0 drivers/net/usb/ch9200.c:354
 usbnet_probe+0xdb0/0x3eb0 drivers/net/usb/usbnet.c:1761
 usb_probe_interface+0xd33/0x12e0 drivers/usb/core/driver.c:396
 really_probe+0x4dc/0xd90 drivers/base/dd.c:658
 __driver_probe_device+0x2ab/0x5d0 drivers/base/dd.c:800
 driver_probe_device+0x72/0x890 drivers/base/dd.c:830
 __device_attach_driver+0x568/0x9e0 drivers/base/dd.c:958
 bus_for_each_drv+0x403/0x620 drivers/base/bus.c:462
 __device_attach+0x3c1/0x650 drivers/base/dd.c:1030
 device_initial_probe+0x32/0x40 drivers/base/dd.c:1079
 bus_probe_device+0x3dc/0x5c0 drivers/base/bus.c:537
 device_add+0x13aa/0x1ba0 drivers/base/core.c:3665
 usb_set_configuration+0x31c9/0x38d0 drivers/usb/core/message.c:2210
 usb_generic_driver_probe+0x109/0x2a0 drivers/usb/core/generic.c:250
 usb_probe_device+0x3a7/0x690 drivers/usb/core/driver.c:291
 really_probe+0x4dc/0xd90 drivers/base/dd.c:658
 __driver_probe_device+0x2ab/0x5d0 drivers/base/dd.c:800
 driver_probe_device+0x72/0x890 drivers/base/dd.c:830
 __device_attach_driver+0x568/0x9e0 drivers/base/dd.c:958
 bus_for_each_drv+0x403/0x620 drivers/base/bus.c:462
 __device_attach+0x3c1/0x650 drivers/base/dd.c:1030
 device_initial_probe+0x32/0x40 drivers/base/dd.c:1079
 bus_probe_device+0x3dc/0x5c0 drivers/base/bus.c:537
 device_add+0x13aa/0x1ba0 drivers/base/core.c:3665
 usb_new_device+0x15f0/0x2470 drivers/usb/core/hub.c:2652
 hub_port_connect drivers/usb/core/hub.c:5523 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5663 [inline]
 port_event drivers/usb/core/hub.c:5823 [inline]
 hub_event+0x4ffb/0x72d0 drivers/usb/core/hub.c:5905
 process_one_work kernel/workqueue.c:3236 [inline]
 process_scheduled_works+0xc1a/0x1e80 kernel/workqueue.c:3317
 worker_thread+0xea7/0x14f0 kernel/workqueue.c:3398
 kthread+0x6b9/0xef0 kernel/kthread.c:464
 ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Local variable buff created at:
 ch9200_mdio_read+0x3c/0x100 drivers/net/usb/ch9200.c:180
 mii_nway_restart+0x8a/0x1e0 drivers/net/mii.c:466

CPU: 1 UID: 0 PID: 3067 Comm: kworker/1:2 Not tainted 6.14.0-rc2-syzkaller-00185-g128c8f96eb86 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Workqueue: usb_hub_wq hub_event
=====================================================

Crashes (17):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/02/15 03:07 upstream 128c8f96eb86 40a34ec9 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mii_nway_restart
2025/02/20 12:05 upstream 87a132e73910 50668798 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mii_nway_restart
2025/02/20 12:05 upstream 87a132e73910 50668798 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mii_nway_restart
2025/02/15 18:17 upstream 7ff71e6d9239 40a34ec9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mii_nway_restart
2025/02/15 18:16 upstream 7ff71e6d9239 40a34ec9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mii_nway_restart
2025/02/14 23:39 upstream 128c8f96eb86 40a34ec9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mii_nway_restart
2025/02/14 23:39 upstream 128c8f96eb86 40a34ec9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mii_nway_restart
2025/02/14 23:39 upstream 128c8f96eb86 40a34ec9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mii_nway_restart
2025/02/14 17:42 upstream 128c8f96eb86 d9a046cf .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mii_nway_restart
2025/02/14 15:11 upstream 128c8f96eb86 d9a046cf .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mii_nway_restart
2025/02/14 15:11 upstream 128c8f96eb86 d9a046cf .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mii_nway_restart
2025/02/20 18:12 upstream 87a132e73910 50668798 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mii_nway_restart
2025/02/20 18:12 upstream 87a132e73910 50668798 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mii_nway_restart
2025/02/18 14:17 upstream 2408a807bfc3 c37c7249 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mii_nway_restart
2025/02/18 14:17 upstream 2408a807bfc3 c37c7249 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mii_nway_restart
2025/02/14 12:34 upstream 128c8f96eb86 d9a046cf .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mii_nway_restart
2025/02/14 12:34 upstream 128c8f96eb86 d9a046cf .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mii_nway_restart
* Struck through repros no longer work on HEAD.