syzbot


KMSAN: uninit-value in ieee80211_rx_handlers (2)

Status: upstream: reported C repro on 2024/03/26 04:05
Subsystems: wireless
[Documentation on labels]
Reported-by: syzbot+75af45a00cf13243ba39@syzkaller.appspotmail.com
Fix commit: wifi: mac80211: check EHT/TTLM action frame length
Patched on: [ci-upstream-linux-next-kasan-gce-root], missing on: [ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-net-next-test-gce ci2-upstream-usb]
First crash: 25d, last: 3d05h
Discussions (2)
Title Replies (including bot) Last reply
[PATCH] wifi: mac80211: check EHT/TTLM action frame length 1 (1) 2024/03/26 20:38
[syzbot] [wireless?] KMSAN: uninit-value in ieee80211_rx_handlers (2) 0 (1) 2024/03/26 04:05
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in ieee80211_rx_handlers wireless C 8 232d 288d 23/26 fixed on 2023/10/12 12:47
upstream general protection fault in ieee80211_rx_handlers wireless 1 439d 435d 0/26 auto-obsoleted due to no activity on 2023/04/03 21:09

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in ieee80211_rx_h_action net/mac80211/rx.c:3783 [inline]
BUG: KMSAN: uninit-value in ieee80211_rx_handlers+0xbeb7/0x10ec0 net/mac80211/rx.c:4188
 ieee80211_rx_h_action net/mac80211/rx.c:3783 [inline]
 ieee80211_rx_handlers+0xbeb7/0x10ec0 net/mac80211/rx.c:4188
 ieee80211_invoke_rx_handlers net/mac80211/rx.c:4223 [inline]
 ieee80211_prepare_and_rx_handle+0x5424/0x99f0 net/mac80211/rx.c:5071
 ieee80211_rx_for_interface+0x88d/0x990 net/mac80211/rx.c:5156
 __ieee80211_rx_handle_packet net/mac80211/rx.c:5312 [inline]
 ieee80211_rx_list+0x5498/0x6690 net/mac80211/rx.c:5447
 ieee80211_rx_napi+0x84/0x3f0 net/mac80211/rx.c:5470
 ieee80211_rx include/net/mac80211.h:5083 [inline]
 ieee80211_tasklet_handler+0x19f/0x330 net/mac80211/main.c:438
 tasklet_action_common+0x395/0xd50 kernel/softirq.c:781
 tasklet_action+0x2d/0x40 kernel/softirq.c:807
 __do_softirq+0x1c0/0x7d7 kernel/softirq.c:554
 do_softirq+0x9a/0x100 kernel/softirq.c:455
 __local_bh_enable_ip+0x9f/0xb0 kernel/softirq.c:382
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 __ieee80211_tx_skb_tid_band+0x28a/0x580 net/mac80211/tx.c:6099
 ieee80211_tx_skb_tid+0x203/0x2a0 net/mac80211/tx.c:6126
 ieee80211_mgmt_tx+0x1c87/0x2210 net/mac80211/offchannel.c:979
 rdev_mgmt_tx net/wireless/rdev-ops.h:758 [inline]
 cfg80211_mlme_mgmt_tx+0xbdd/0x1b90 net/wireless/mlme.c:937
 nl80211_tx_mgmt+0xfb0/0x1570 net/wireless/nl80211.c:12650
 genl_family_rcv_msg_doit net/netlink/genetlink.c:1113 [inline]
 genl_family_rcv_msg net/netlink/genetlink.c:1193 [inline]
 genl_rcv_msg+0x1214/0x12c0 net/netlink/genetlink.c:1208
 netlink_rcv_skb+0x375/0x650 net/netlink/af_netlink.c:2559
 genl_rcv+0x40/0x60 net/netlink/genetlink.c:1217
 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
 netlink_unicast+0xf4c/0x1260 net/netlink/af_netlink.c:1361
 netlink_sendmsg+0x10df/0x11f0 net/netlink/af_netlink.c:1905
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg+0x30f/0x380 net/socket.c:745
 ____sys_sendmsg+0x877/0xb60 net/socket.c:2584
 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638
 __sys_sendmsg net/socket.c:2667 [inline]
 __do_sys_sendmsg net/socket.c:2676 [inline]
 __se_sys_sendmsg net/socket.c:2674 [inline]
 __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2674
 do_syscall_64+0xd5/0x1f0
 entry_SYSCALL_64_after_hwframe+0x6d/0x75

Uninit was created at:
 slab_post_alloc_hook mm/slub.c:3804 [inline]
 slab_alloc_node mm/slub.c:3845 [inline]
 kmem_cache_alloc_node+0x613/0xc50 mm/slub.c:3888
 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577
 __alloc_skb+0x35b/0x7a0 net/core/skbuff.c:668
 skb_copy+0x116/0xa10 net/core/skbuff.c:2128
 mac80211_hwsim_tx_frame_no_nl+0x18e1/0x2130 drivers/net/wireless/virtual/mac80211_hwsim.c:1854
 mac80211_hwsim_tx+0x1c3b/0x2d90 drivers/net/wireless/virtual/mac80211_hwsim.c:2072
 drv_tx net/mac80211/driver-ops.h:37 [inline]
 ieee80211_tx_frags+0x5ea/0xd90 net/mac80211/tx.c:1731
 __ieee80211_tx+0x470/0x640 net/mac80211/tx.c:1785
 ieee80211_tx+0x532/0x570 net/mac80211/tx.c:1965
 ieee80211_xmit+0x54a/0x5b0 net/mac80211/tx.c:2057
 __ieee80211_tx_skb_tid_band+0x27d/0x580 net/mac80211/tx.c:6098
 ieee80211_tx_skb_tid+0x203/0x2a0 net/mac80211/tx.c:6126
 ieee80211_mgmt_tx+0x1c87/0x2210 net/mac80211/offchannel.c:979
 rdev_mgmt_tx net/wireless/rdev-ops.h:758 [inline]
 cfg80211_mlme_mgmt_tx+0xbdd/0x1b90 net/wireless/mlme.c:937
 nl80211_tx_mgmt+0xfb0/0x1570 net/wireless/nl80211.c:12650
 genl_family_rcv_msg_doit net/netlink/genetlink.c:1113 [inline]
 genl_family_rcv_msg net/netlink/genetlink.c:1193 [inline]
 genl_rcv_msg+0x1214/0x12c0 net/netlink/genetlink.c:1208
 netlink_rcv_skb+0x375/0x650 net/netlink/af_netlink.c:2559
 genl_rcv+0x40/0x60 net/netlink/genetlink.c:1217
 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
 netlink_unicast+0xf4c/0x1260 net/netlink/af_netlink.c:1361
 netlink_sendmsg+0x10df/0x11f0 net/netlink/af_netlink.c:1905
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg+0x30f/0x380 net/socket.c:745
 ____sys_sendmsg+0x877/0xb60 net/socket.c:2584
 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638
 __sys_sendmsg net/socket.c:2667 [inline]
 __do_sys_sendmsg net/socket.c:2676 [inline]
 __se_sys_sendmsg net/socket.c:2674 [inline]
 __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2674
 do_syscall_64+0xd5/0x1f0
 entry_SYSCALL_64_after_hwframe+0x6d/0x75

CPU: 1 PID: 5018 Comm: syz-executor547 Not tainted 6.8.0-syzkaller-13006-g4f55aa85a874 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
=====================================================

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/03/23 05:55 upstream 4f55aa85a874 0ea90952 .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in ieee80211_rx_handlers
2024/04/13 16:05 upstream 8f2c057754b2 c8349e48 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in ieee80211_rx_handlers
2024/03/22 03:52 upstream 241590e5a1d1 6753db5c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in ieee80211_rx_handlers
2024/04/13 16:11 upstream 8f2c057754b2 c8349e48 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in ieee80211_rx_handlers
* Struck through repros no longer work on HEAD.