syzbot


KMSAN: uninit-value in batadv_bla_tx

Status: closed as dup on 2020/01/31 19:23
Subsystems: batman
[Documentation on labels]
Reported-by: syzbot+37bad4f9cb2033876f32@syzkaller.appspotmail.com
First crash: 1760d, last: 1582d
Duplicate of
Title Repro Cause bisect Fix bisect Count Last Reported
KMSAN: uninit-value in batadv_interface_tx (2) batman 19 1583d 1759d
Discussions (1)
Title Replies (including bot) Last reply
KMSAN: uninit-value in batadv_bla_tx 1 (2) 2020/01/31 19:22

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in batadv_bla_tx+0x2cec/0x4510 net/batman-adv/bridge_loop_avoidance.c:1960
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.8.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1df/0x240 lib/dump_stack.c:118
 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:121
 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215
 batadv_bla_tx+0x2cec/0x4510 net/batman-adv/bridge_loop_avoidance.c:1960
 batadv_interface_tx+0x67c/0x2450 net/batman-adv/soft-interface.c:240
 __netdev_start_xmit include/linux/netdevice.h:4611 [inline]
 netdev_start_xmit include/linux/netdevice.h:4625 [inline]
 xmit_one net/core/dev.c:3556 [inline]
 dev_hard_start_xmit+0x50e/0xa70 net/core/dev.c:3572
 __dev_queue_xmit+0x2f8d/0x3b20 net/core/dev.c:4131
 dev_queue_xmit+0x4b/0x60 net/core/dev.c:4164
 hsr_xmit net/hsr/hsr_forward.c:228 [inline]
 hsr_forward_do net/hsr/hsr_forward.c:285 [inline]
 hsr_forward_skb+0x1f07/0x31f0 net/hsr/hsr_forward.c:361
 hsr_handle_frame+0x3be/0x500 net/hsr/hsr_slave.c:44
 __netif_receive_skb_core+0x213f/0x5890 net/core/dev.c:5175
 __netif_receive_skb_one_core net/core/dev.c:5279 [inline]
 __netif_receive_skb net/core/dev.c:5395 [inline]
 process_backlog+0x605/0x14e0 net/core/dev.c:6239
 napi_poll net/core/dev.c:6684 [inline]
 net_rx_action+0x746/0x1aa0 net/core/dev.c:6752
 __do_softirq+0x311/0x83d kernel/softirq.c:293
 asm_call_on_stack+0x12/0x20 arch/x86/entry/entry_64.S:711
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:23 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:50 [inline]
 do_softirq_own_stack+0x7c/0xa0 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:390 [inline]
 __irq_exit_rcu+0x226/0x270 kernel/softirq.c:420
 irq_exit_rcu+0xe/0x10 kernel/softirq.c:432
 sysvec_apic_timer_interrupt+0x107/0x130 arch/x86/kernel/apic/apic.c:1091
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:593
RIP: 0010:native_irq_disable arch/x86/include/asm/irqflags.h:49 [inline]
RIP: 0010:arch_local_irq_disable arch/x86/include/asm/irqflags.h:89 [inline]
RIP: 0010:acpi_safe_halt drivers/acpi/processor_idle.c:112 [inline]
RIP: 0010:acpi_idle_do_entry drivers/acpi/processor_idle.c:525 [inline]
RIP: 0010:acpi_idle_enter+0x6de/0xb90 drivers/acpi/processor_idle.c:651
Code: 78 9f e8 85 87 e3 fc 83 38 00 4c 8b 65 b0 0f 85 3d 01 00 00 85 db 0f 8e 44 01 00 00 e8 8b 8a 76 fc 0f 00 2d 8e 3d ca 09 fb f4 <fa> eb 57 e8 7a 8a 76 fc 4c 8b 65 b0 eb 4c 84 d2 8b bd 7c ff ff ff
RSP: 0018:ffffffff9ec03b78 EFLAGS: 00000293
RAX: ffffffff942d92d9 RBX: 0000000000000000 RCX: ffffffff9ec2cf40
RDX: 0000000000000000 RSI: 00000000000001a0 RDI: ffffffff9f78c788
RBP: ffffffff9ec03c40 R08: fffffc19c000000f R09: ffff97d86fffb000
R10: 00000000000002a9 R11: ffffffff942d8ac0 R12: 0000000000000001
R13: 0000000000000001 R14: ffff97d95d308064 R15: 0000000000000000
 cpuidle_enter_state+0x69b/0xf50 drivers/cpuidle/cpuidle.c:235
 cpuidle_enter+0xe3/0x170 drivers/cpuidle/cpuidle.c:346
 call_cpuidle kernel/sched/idle.c:126 [inline]
 cpuidle_idle_call kernel/sched/idle.c:214 [inline]
 do_idle+0x668/0x810 kernel/sched/idle.c:276
 cpu_startup_entry+0x45/0x50 kernel/sched/idle.c:372
 rest_init+0x1be/0x1f0 init/main.c:706
 arch_call_rest_init+0x13/0x15
 start_kernel+0x993/0xb5f init/main.c:1046
 x86_64_start_reservations+0x18/0x28 arch/x86/kernel/head64.c:490
 x86_64_start_kernel+0x83/0x86 arch/x86/kernel/head64.c:471
 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:243

Uninit was stored to memory at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:144 [inline]
 kmsan_internal_chain_origin+0xad/0x130 mm/kmsan/kmsan.c:310
 kmsan_memcpy_memmove_metadata+0x272/0x2e0 mm/kmsan/kmsan.c:247
 kmsan_memcpy_metadata+0xb/0x10 mm/kmsan/kmsan.c:267
 __msan_memcpy+0x43/0x50 mm/kmsan/kmsan_instr.c:116
 pskb_expand_head+0x38b/0x1b00 net/core/skbuff.c:1636
 __skb_pad+0x47f/0x900 net/core/skbuff.c:1804
 __skb_put_padto include/linux/skbuff.h:3218 [inline]
 skb_put_padto include/linux/skbuff.h:3237 [inline]
 send_hsr_supervision_frame+0x122d/0x1500 net/hsr/hsr_device.c:299
 hsr_announce+0x1e2/0x370 net/hsr/hsr_device.c:330
 call_timer_fn+0x218/0x510 kernel/time/timer.c:1404
 expire_timers kernel/time/timer.c:1449 [inline]
 __run_timers+0xd20/0x11c0 kernel/time/timer.c:1773
 run_timer_softirq+0x2d/0x50 kernel/time/timer.c:1786
 __do_softirq+0x311/0x83d kernel/softirq.c:293

Uninit was created at:
 kmsan_save_stack_with_flags+0x3c/0x90 mm/kmsan/kmsan.c:144
 kmsan_internal_alloc_meta_for_pages mm/kmsan/kmsan_shadow.c:269 [inline]
 kmsan_alloc_page+0xb9/0x180 mm/kmsan/kmsan_shadow.c:293
 __alloc_pages_nodemask+0x56a2/0x5dc0 mm/page_alloc.c:4889
 __alloc_pages include/linux/gfp.h:509 [inline]
 __alloc_pages_node include/linux/gfp.h:522 [inline]
 alloc_pages_node include/linux/gfp.h:536 [inline]
 __page_frag_cache_refill mm/page_alloc.c:4964 [inline]
 page_frag_alloc+0x3ae/0x910 mm/page_alloc.c:4994
 __napi_alloc_skb+0x193/0xa60 net/core/skbuff.c:519
 napi_alloc_skb include/linux/skbuff.h:2850 [inline]
 page_to_skb+0x1a2/0x1390 drivers/net/virtio_net.c:384
 receive_mergeable drivers/net/virtio_net.c:944 [inline]
 receive_buf+0xf9e/0x9760 drivers/net/virtio_net.c:1054
 virtnet_receive drivers/net/virtio_net.c:1346 [inline]
 virtnet_poll+0x64b/0x19f0 drivers/net/virtio_net.c:1451
 napi_poll net/core/dev.c:6684 [inline]
 net_rx_action+0x746/0x1aa0 net/core/dev.c:6752
 __do_softirq+0x311/0x83d kernel/softirq.c:293
=====================================================

Crashes (13):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/07/25 03:56 https://github.com/google/kmsan.git master 93f54a72361a 554af388 .config console log report syz C ci-upstream-kmsan-gce
2020/07/05 15:21 https://github.com/google/kmsan.git master f0d5ec902b23 51095195 .config console log report syz C ci-upstream-kmsan-gce
2020/04/02 11:17 https://github.com/google/kmsan.git master 75303409203b a34e2c33 .config console log report syz C ci-upstream-kmsan-gce
2020/03/30 02:17 https://github.com/google/kmsan.git master 75303409203b 05736b29 .config console log report syz C ci-upstream-kmsan-gce
2020/03/21 18:03 https://github.com/google/kmsan.git master a58741ac26cc 4288d95e .config console log report syz C ci-upstream-kmsan-gce
2020/03/16 11:49 https://github.com/google/kmsan.git master 8bbbc5cf3dca 749688d2 .config console log report syz C ci-upstream-kmsan-gce
2020/01/30 18:13 https://github.com/google/kmsan.git master 686a4f77cb0c 5ed23f9a .config console log report syz C ci-upstream-kmsan-gce
2020/07/26 05:23 https://github.com/google/kmsan.git master 93f54a72361a 1f7cc1ca .config console log report syz C ci-upstream-kmsan-gce-386
2020/04/07 16:11 https://github.com/google/kmsan.git master 75303409203b 99a96044 .config console log report syz C ci-upstream-kmsan-gce-386
2020/02/27 10:09 https://github.com/google/kmsan.git master 8bbbc5cf3dca 59b57593 .config console log report ci-upstream-kmsan-gce
2020/06/01 22:02 https://github.com/google/kmsan.git master f0d5ec902b23 a0331e89 .config console log report ci-upstream-kmsan-gce-386
2020/05/18 21:25 https://github.com/google/kmsan.git master 8b97c6271626 684d3606 .config console log report ci-upstream-kmsan-gce-386
2020/03/03 07:46 https://github.com/google/kmsan.git master 8bbbc5cf3dca c88c7b75 .config console log report ci-upstream-kmsan-gce-386
* Struck through repros no longer work on HEAD.