syzbot


KMSAN: uninit-value in __ipv6_dev_mc_dec (2)

Status: upstream: reported on 2025/05/09 19:59
Subsystems: net
[Documentation on labels]
Reported-by: syzbot+4472ecce287501aa597a@syzkaller.appspotmail.com
First crash: 2d03h, last: 7h21m
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [net?] KMSAN: uninit-value in __ipv6_dev_mc_dec (2) 0 (1) 2025/05/09 19:59
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in __ipv6_dev_mc_dec net 5 1191d 1248d 0/28 auto-closed as invalid on 2022/05/05 07:39

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in __ipv6_dev_mc_dec+0x68a/0xd30 net/ipv6/mcast.c:1014
 __ipv6_dev_mc_dec+0x68a/0xd30 net/ipv6/mcast.c:1014
 addrconf_leave_solict net/ipv6/addrconf.c:2254 [inline]
 __ipv6_ifa_notify+0xf97/0x1990 net/ipv6/addrconf.c:6299
 addrconf_ifdown+0x1c61/0x32e0 net/ipv6/addrconf.c:3978
 addrconf_notify+0x183/0x1d10 net/ipv6/addrconf.c:3777
 notifier_call_chain kernel/notifier.c:85 [inline]
 raw_notifier_call_chain+0xdd/0x410 kernel/notifier.c:453
 call_netdevice_notifiers_info+0x1ac/0x2b0 net/core/dev.c:2176
 call_netdevice_notifiers_extack net/core/dev.c:2214 [inline]
 call_netdevice_notifiers net/core/dev.c:2228 [inline]
 dev_close_many+0x52a/0x8f0 net/core/dev.c:1731
 unregister_netdevice_many_notify+0x1106/0x4970 net/core/dev.c:11952
 unregister_netdevice_many net/core/dev.c:12046 [inline]
 unregister_netdevice_queue+0x3b1/0x600 net/core/dev.c:11889
 unregister_netdevice include/linux/netdevice.h:3374 [inline]
 __tun_detach+0x16c8/0x20c0 drivers/net/tun.c:620
 tun_detach drivers/net/tun.c:636 [inline]
 tun_chr_close+0xb7/0x290 drivers/net/tun.c:3390
 __fput+0x608/0x1040 fs/file_table.c:465
 ____fput+0x25/0x30 fs/file_table.c:493
 task_work_run+0x206/0x2b0 kernel/task_work.c:227
 resume_user_mode_work+0x105/0x160 include/linux/resume_user_mode.h:50
 exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x7b/0xb0 kernel/entry/common.c:218
 __do_fast_syscall_32+0xbd/0x110 arch/x86/entry/syscall_32.c:309
 do_fast_syscall_32+0x38/0x80 arch/x86/entry/syscall_32.c:331
 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:369
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e

Local variable maddr.i created at:
 addrconf_leave_solict net/ipv6/addrconf.c:2248 [inline]
 __ipv6_ifa_notify+0xe6f/0x1990 net/ipv6/addrconf.c:6299
 addrconf_ifdown+0x1c61/0x32e0 net/ipv6/addrconf.c:3978

CPU: 1 UID: 0 PID: 15620 Comm: syz.0.3696 Not tainted 6.15.0-rc3-syzkaller-00094-g02ddfb981de8 #0 PREEMPT(undef) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
=====================================================

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/05/10 07:56 upstream 02ddfb981de8 77908e5f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in __ipv6_dev_mc_dec
2025/05/08 17:32 upstream 02ddfb981de8 dbf35fa1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in __ipv6_dev_mc_dec
2025/05/08 17:13 upstream 02ddfb981de8 dbf35fa1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in __ipv6_dev_mc_dec
2025/05/08 16:43 upstream 02ddfb981de8 dbf35fa1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in __ipv6_dev_mc_dec
2025/05/08 11:58 upstream 02ddfb981de8 dbf35fa1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in __ipv6_dev_mc_dec
* Struck through repros no longer work on HEAD.