syzbot

 sign-in | mailing list | source | docs
🐞 Open [1547]
≡ Subsystems
🐞 Fixed [5903]
🐞 Invalid [14364]
⬇ Missing Backports [98]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
💬 Send us feedback

KMSAN: uninit-value in number (2)

Status: fixed on 2021/03/10 01:48
Subsystems: can
[Documentation on labels]
Reported-by: syzbot+9bcb0c9409066696d3aa@syzkaller.appspotmail.com
Fix commit: c8c958a58fc6 can: af_can: prevent potential access of uninitialized member in can_rcv() 9aa9379d8f86 can: af_can: prevent potential access of uninitialized member in canfd_rcv()
First crash: 1755d, last: 1374d
▶ ▼ Discussions (11)
Title Replies (including bot) Last reply
[PATCH 5.4 000/158] 5.4.80-rc1 review 166 (166) 2020/12/11 20:25
[PATCH 4.19 00/91] 4.19.160-rc1 review 98 (98) 2020/11/24 22:52
[PATCH 5.9 000/252] 5.9.11-rc1 review 259 (259) 2020/11/24 20:28
[PATCH 4.14 00/60] 4.14.209-rc1 review 63 (63) 2020/11/24 07:21
pull-request: can 2020-11-15 21 (21) 2020/11/17 14:02
pull-request: can 2020-11-14 21 (21) 2020/11/16 15:33
[PATCH 0/2] prevent potential access of uninitialized members in can_rcv() and canfd_rcv() 4 (4) 2020/11/03 22:17
[PATCH] net: can: prevent potential access of uninitialized value in canfd_rcv() 4 (4) 2020/11/02 08:28
[PATCH v2] can: af_can: can_rcv() canfd_rcv(): Fix access of uninitialized memory or out of bounds 4 (4) 2020/02/26 05:34
[RFC] can: af_can: can_rcv() canfd_rcv(): Fix access of uninitialized memory or out of bounds 3 (3) 2020/02/25 20:34
KMSAN: uninit-value in number (2) 1 (2) 2020/02/24 08:54
▶ ▼ Similar bugs (6)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in number (4) kernel C 7189 750d 1128d 0/28 closed as invalid on 2022/11/28 10:01
upstream KMSAN: uninit-value in number media usb C 190 1763d 1861d 15/28 fixed on 2020/02/18 14:31
upstream KMSAN: uninit-value in number (3) media C 8575 1128d 1372d 20/28 fixed on 2021/11/10 00:50
upstream Internal error in number (2) net 1 220d 216d 0/28 auto-obsoleted due to no activity on 2024/08/04 18:51
upstream Internal error in number net 1 393d 389d 0/28 auto-obsoleted due to no activity on 2024/02/13 14:45
upstream BUG: unable to handle kernel NULL pointer dereference in number (2) kernel 2 107d 114d 0/28 closed as invalid on 2024/09/13 11:13
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2020/10/31 23:45 16m anant.thazhemadam@gmail.com https://github.com/google/kmsan.git master report log

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in number+0x9f8/0x2000 lib/vsprintf.c:459
CPU: 1 PID: 11897 Comm: syz-executor136 Not tainted 5.6.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c9/0x220 lib/dump_stack.c:118
 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118
 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215
 number+0x9f8/0x2000 lib/vsprintf.c:459
 vsnprintf+0x1d85/0x31b0 lib/vsprintf.c:2640
 vscnprintf+0xc2/0x180 lib/vsprintf.c:2677
 vprintk_store+0xef/0x11d0 kernel/printk/printk.c:1917
 vprintk_emit+0x2c0/0x860 kernel/printk/printk.c:1984
 vprintk_default+0x90/0xa0 kernel/printk/printk.c:2029
 vprintk_func+0x636/0x820 kernel/printk/printk_safe.c:386
 printk+0x18b/0x1d3 kernel/printk/printk.c:2062
 canfd_rcv+0x370/0x3a0 net/can/af_can.c:697
 __netif_receive_skb_one_core net/core/dev.c:5198 [inline]
 __netif_receive_skb net/core/dev.c:5312 [inline]
 netif_receive_skb_internal net/core/dev.c:5402 [inline]
 netif_receive_skb+0xe77/0xf20 net/core/dev.c:5461
 tun_rx_batched include/linux/skbuff.h:4321 [inline]
 tun_get_user+0x6aef/0x6f60 drivers/net/tun.c:1997
 tun_chr_write_iter+0x1f2/0x360 drivers/net/tun.c:2026
 call_write_iter include/linux/fs.h:1901 [inline]
 new_sync_write fs/read_write.c:483 [inline]
 __vfs_write+0xa5a/0xca0 fs/read_write.c:496
 vfs_write+0x44a/0x8f0 fs/read_write.c:558
 ksys_write+0x267/0x450 fs/read_write.c:611
 __do_sys_write fs/read_write.c:623 [inline]
 __se_sys_write+0x92/0xb0 fs/read_write.c:620
 __x64_sys_write+0x4a/0x70 fs/read_write.c:620
 do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x440239
Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffd3d6d1f28 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000003172 RCX: 0000000000440239
RDX: 0000000000000004 RSI: 0000000020000200 RDI: 0000000000000003
RBP: 656c6c616b7a7973 R08: 0000000000401ac0 R09: 0000000000401ac0
R10: 0000000000401ac0 R11: 0000000000000246 R12: 0000000000401ac0
R13: 0000000000401b50 R14: 0000000000000000 R15: 0000000000000000

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:144 [inline]
 kmsan_internal_poison_shadow+0x66/0xd0 mm/kmsan/kmsan.c:127
 kmsan_slab_alloc+0x8a/0xe0 mm/kmsan/kmsan_hooks.c:82
 slab_alloc_node mm/slub.c:2793 [inline]
 __kmalloc_node_track_caller+0xb40/0x1200 mm/slub.c:4401
 __kmalloc_reserve net/core/skbuff.c:142 [inline]
 __alloc_skb+0x2fd/0xac0 net/core/skbuff.c:210
 alloc_skb include/linux/skbuff.h:1051 [inline]
 alloc_skb_with_frags+0x18c/0xa70 net/core/skbuff.c:5766
 sock_alloc_send_pskb+0xada/0xc60 net/core/sock.c:2242
 tun_alloc_skb drivers/net/tun.c:1529 [inline]
 tun_get_user+0x10ae/0x6f60 drivers/net/tun.c:1843
 tun_chr_write_iter+0x1f2/0x360 drivers/net/tun.c:2026
 call_write_iter include/linux/fs.h:1901 [inline]
 new_sync_write fs/read_write.c:483 [inline]
 __vfs_write+0xa5a/0xca0 fs/read_write.c:496
 vfs_write+0x44a/0x8f0 fs/read_write.c:558
 ksys_write+0x267/0x450 fs/read_write.c:611
 __do_sys_write fs/read_write.c:623 [inline]
 __se_sys_write+0x92/0xb0 fs/read_write.c:620
 __x64_sys_write+0x4a/0x70 fs/read_write.c:620
 do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
=====================================================

Crashes (168):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/02/22 04:30 https://github.com/google/kmsan.git master 8bbbc5cf3dca 2ffa6679 .config console log report syz C ci-upstream-kmsan-gce
2021/03/09 09:55 https://github.com/google/kmsan.git master 29ad81a1074a 09fbf400 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in number
2021/03/08 23:58 https://github.com/google/kmsan.git master 29ad81a1074a 09fbf400 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in number
2021/03/08 09:32 https://github.com/google/kmsan.git master 29ad81a1074a 09fbf400 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in number
2021/03/07 20:47 https://github.com/google/kmsan.git master 29ad81a1074a 75506d9c .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in number
2021/03/07 14:07 https://github.com/google/kmsan.git master 29ad81a1074a 75506d9c .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in number
2021/03/05 23:03 https://github.com/google/kmsan.git master 29ad81a1074a 56722561 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in number
2021/03/04 11:58 https://github.com/google/kmsan.git master 29ad81a1074a d7e4e604 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in number
2021/02/28 03:30 https://github.com/google/kmsan.git master 29ad81a1074a 4c37c133 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in number
2021/02/27 08:36 https://github.com/google/kmsan.git master 29ad81a1074a 4c37c133 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in number
2021/02/25 01:45 https://github.com/google/kmsan.git master 29ad81a1074a fcc6d71b .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in number
2021/02/24 17:55 https://github.com/google/kmsan.git master 29ad81a1074a fcc6d71b .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in number
2021/02/22 05:33 https://github.com/google/kmsan.git master 29ad81a1074a a659b3f1 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in number
2021/02/20 18:25 https://github.com/google/kmsan.git master 29ad81a1074a 3e5ed8b4 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in number
2021/02/19 19:20 https://github.com/google/kmsan.git master 29ad81a1074a f689d40a .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in number
2021/02/19 00:40 https://github.com/google/kmsan.git master 29ad81a1074a 14052202 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in number
2021/02/18 18:48 https://github.com/google/kmsan.git master 29ad81a1074a 14052202 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in number
2021/02/17 12:33 https://github.com/google/kmsan.git master 29ad81a1074a 052f8d9f .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in number
2021/02/16 10:34 https://github.com/google/kmsan.git master 29ad81a1074a 98682e5e .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in number
2021/02/16 06:27 https://github.com/google/kmsan.git master 29ad81a1074a 98682e5e .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in number
2021/02/16 00:08 https://github.com/google/kmsan.git master 29ad81a1074a 98682e5e .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in number
2021/02/13 09:16 https://github.com/google/kmsan.git master 29ad81a1074a 98682e5e .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in number
2021/01/25 21:52 https://github.com/google/kmsan.git master 73d62e81b476 52e37319 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in number
2021/01/25 19:42 https://github.com/google/kmsan.git master 73d62e81b476 52e37319 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in number
2021/01/18 09:12 https://github.com/google/kmsan.git master 73d62e81b476 fd103621 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in number
2021/02/15 12:48 https://github.com/google/kmsan.git master 29ad81a1074a 98682e5e .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in number
2021/01/17 06:12 https://github.com/google/kmsan.git master 73d62e81b476 65a7a854 .config console log report info ci-upstream-kmsan-gce
2021/01/11 05:19 https://github.com/google/kmsan.git master 73d62e81b476 2c1f2513 .config console log report info ci-upstream-kmsan-gce
2021/01/10 04:38 https://github.com/google/kmsan.git master 73d62e81b476 2c1f2513 .config console log report info ci-upstream-kmsan-gce
2021/01/09 23:15 https://github.com/google/kmsan.git master 73d62e81b476 2c1f2513 .config console log report info ci-upstream-kmsan-gce
2021/01/07 16:10 https://github.com/google/kmsan.git master 73d62e81b476 c104d4a3 .config console log report info ci-upstream-kmsan-gce
2021/01/07 14:51 https://github.com/google/kmsan.git master 73d62e81b476 c104d4a3 .config console log report info ci-upstream-kmsan-gce
2021/01/07 04:37 https://github.com/google/kmsan.git master 73d62e81b476 c104d4a3 .config console log report info ci-upstream-kmsan-gce
2021/01/05 01:17 https://github.com/google/kmsan.git master 73d62e81b476 2a28ff1f .config console log report info ci-upstream-kmsan-gce
2021/01/04 02:45 https://github.com/google/kmsan.git master 73d62e81b476 79264ae3 .config console log report info ci-upstream-kmsan-gce
2021/01/03 11:23 https://github.com/google/kmsan.git master 73d62e81b476 79264ae3 .config console log report info ci-upstream-kmsan-gce
2020/12/31 04:22 https://github.com/google/kmsan.git master 73d62e81b476 5cc121d6 .config console log report info ci-upstream-kmsan-gce
2020/12/30 18:53 https://github.com/google/kmsan.git master 73d62e81b476 ecb8c012 .config console log report info ci-upstream-kmsan-gce
2020/12/30 11:36 https://github.com/google/kmsan.git master 73d62e81b476 0fa352f2 .config console log report info ci-upstream-kmsan-gce
2020/12/29 19:46 https://github.com/google/kmsan.git master 73d62e81b476 80910769 .config console log report info ci-upstream-kmsan-gce
2020/12/29 17:58 https://github.com/google/kmsan.git master 73d62e81b476 80910769 .config console log report info ci-upstream-kmsan-gce
2020/12/29 04:04 https://github.com/google/kmsan.git master 73d62e81b476 8259d56c .config console log report info ci-upstream-kmsan-gce
2020/12/29 02:01 https://github.com/google/kmsan.git master 73d62e81b476 8259d56c .config console log report info ci-upstream-kmsan-gce
2020/12/28 18:36 https://github.com/google/kmsan.git master 73d62e81b476 8259d56c .config console log report info ci-upstream-kmsan-gce
2020/12/28 09:35 https://github.com/google/kmsan.git master 73d62e81b476 2242f77f .config console log report info ci-upstream-kmsan-gce
2020/12/28 08:18 https://github.com/google/kmsan.git master 73d62e81b476 2242f77f .config console log report info ci-upstream-kmsan-gce
2020/02/22 03:07 https://github.com/google/kmsan.git master 8bbbc5cf3dca 2ffa6679 .config console log report ci-upstream-kmsan-gce
2021/01/06 10:39 https://github.com/google/kmsan.git master 73d62e81b476 b1c228e1 .config console log report info ci-upstream-kmsan-gce-386
2021/01/05 20:05 https://github.com/google/kmsan.git master 73d62e81b476 a0234d98 .config console log report info ci-upstream-kmsan-gce-386
2021/01/03 12:28 https://github.com/google/kmsan.git master 73d62e81b476 79264ae3 .config console log report info ci-upstream-kmsan-gce-386
2020/12/31 12:38 https://github.com/google/kmsan.git master 73d62e81b476 5cc121d6 .config console log report info ci-upstream-kmsan-gce-386
2020/12/30 09:23 https://github.com/google/kmsan.git master 73d62e81b476 0fa352f2 .config console log report info ci-upstream-kmsan-gce-386
2020/12/29 21:02 https://github.com/google/kmsan.git master 73d62e81b476 80910769 .config console log report info ci-upstream-kmsan-gce-386
* Struck through repros no longer work on HEAD.