syzbot


KMSAN: uninit-value in eir_get_service_data

Status: upstream: reported C repro on 2024/01/01 10:44
Subsystems: bluetooth
[Documentation on labels]
Reported-by: syzbot+5e132fbe94a9ede456ad@syzkaller.appspotmail.com
First crash: 149d, last: 41d
Discussions (3)
Title Replies (including bot) Last reply
[syzbot] Monthly bluetooth report (Mar 2024) 0 (1) 2024/03/06 22:08
[syzbot] Monthly bluetooth report (Feb 2024) 0 (1) 2024/02/04 13:30
[syzbot] [bluetooth?] KMSAN: uninit-value in eir_get_service_data 0 (1) 2024/01/01 10:44
Last patch testing requests (2)
Created Duration User Patch Repo Result
2024/02/17 02:04 23m retest repro upstream OK log
2023/12/08 15:21 34m retest repro upstream report log

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in eir_get_data net/bluetooth/eir.h:73 [inline]
BUG: KMSAN: uninit-value in eir_get_service_data+0x25c/0x570 net/bluetooth/eir.c:384
 eir_get_data net/bluetooth/eir.h:73 [inline]
 eir_get_service_data+0x25c/0x570 net/bluetooth/eir.c:384
 iso_connect_ind+0x2004/0x2330 net/bluetooth/iso.c:1794
 hci_proto_connect_ind include/net/bluetooth/hci_core.h:1922 [inline]
 hci_le_per_adv_report_evt+0xc0/0x1e0 net/bluetooth/hci_event.c:6645
 hci_le_meta_evt+0x608/0x860 net/bluetooth/hci_event.c:7344
 hci_event_func net/bluetooth/hci_event.c:7674 [inline]
 hci_event_packet+0x1183/0x1be0 net/bluetooth/hci_event.c:7729
 hci_rx_work+0x687/0x1120 net/bluetooth/hci_core.c:4105
 process_one_work kernel/workqueue.c:2630 [inline]
 process_scheduled_works+0x104e/0x1e70 kernel/workqueue.c:2703
 worker_thread+0xf45/0x1490 kernel/workqueue.c:2784
 kthread+0x3ed/0x540 kernel/kthread.c:388
 ret_from_fork+0x66/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242

Uninit was created at:
 slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768
 slab_alloc_node mm/slub.c:3478 [inline]
 kmem_cache_alloc_node+0x5e9/0xb10 mm/slub.c:3523
 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560
 __alloc_skb+0x318/0x740 net/core/skbuff.c:651
 alloc_skb include/linux/skbuff.h:1286 [inline]
 bt_skb_alloc include/net/bluetooth/bluetooth.h:487 [inline]
 vhci_get_user drivers/bluetooth/hci_vhci.c:495 [inline]
 vhci_write+0x126/0x8f0 drivers/bluetooth/hci_vhci.c:615
 call_write_iter include/linux/fs.h:2020 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x8ef/0x1490 fs/read_write.c:584
 ksys_write+0x20f/0x4c0 fs/read_write.c:637
 __do_sys_write fs/read_write.c:649 [inline]
 __se_sys_write fs/read_write.c:646 [inline]
 __x64_sys_write+0x93/0xd0 fs/read_write.c:646
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x63/0x6b

CPU: 1 PID: 4386 Comm: kworker/u5:1 Not tainted 6.7.0-rc1-syzkaller-00019-gc42d9eeef8e5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
Workqueue: hci0 hci_rx_work
=====================================================

Crashes (22):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/11/16 06:19 upstream c42d9eeef8e5 cb976f63 .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce KMSAN: uninit-value in eir_get_service_data
2024/02/24 10:01 upstream 603c04e27c3e 8d446f15 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in eir_get_service_data
2024/01/27 17:57 upstream 9f8413c4a66f cc4a4020 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in eir_get_service_data
2024/01/26 09:19 upstream 9f8413c4a66f cc4a4020 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in eir_get_service_data
2024/01/15 18:32 upstream 9f8413c4a66f 2a7bcc7f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in eir_get_service_data
2024/01/15 16:26 upstream 9f8413c4a66f 2a7bcc7f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in eir_get_service_data
2024/01/15 02:34 upstream 9f8413c4a66f 551587c1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in eir_get_service_data
2024/01/10 20:17 upstream 9f8413c4a66f 04815ef1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in eir_get_service_data
2024/01/10 19:39 upstream 9f8413c4a66f 04815ef1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in eir_get_service_data
2023/12/31 19:35 upstream 453f5db0619e fb427a07 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in eir_get_service_data
2023/12/31 19:09 upstream 453f5db0619e fb427a07 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in eir_get_service_data
2023/12/19 14:09 upstream 2cf4f94d8e86 3ad490ea .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce KMSAN: uninit-value in eir_get_service_data
2023/12/15 10:39 upstream c7402612e2e6 3222d10c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce KMSAN: uninit-value in eir_get_service_data
2023/11/24 07:13 upstream d3fa86b1a7b4 5b429f39 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce KMSAN: uninit-value in eir_get_service_data
2023/11/16 04:53 upstream c42d9eeef8e5 cb976f63 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce KMSAN: uninit-value in eir_get_service_data
2024/03/02 23:21 upstream 5ad3cb0ed525 25905f5d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in eir_get_service_data
2024/01/27 18:00 upstream 9f8413c4a66f cc4a4020 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in eir_get_service_data
2024/01/26 09:21 upstream 9f8413c4a66f cc4a4020 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in eir_get_service_data
2024/01/15 02:37 upstream 9f8413c4a66f 551587c1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in eir_get_service_data
2024/01/15 02:35 upstream 9f8413c4a66f 551587c1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in eir_get_service_data
2023/12/31 19:39 upstream 453f5db0619e fb427a07 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in eir_get_service_data
2023/12/31 19:09 upstream 453f5db0619e fb427a07 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in eir_get_service_data
* Struck through repros no longer work on HEAD.