syzbot


KMSAN: uninit-value in hci_cmd_complete_evt

Status: upstream: reported on 2024/11/16 13:13
Subsystems: bluetooth
[Documentation on labels]
Reported-by: syzbot+a9a4bedfca6aa9d7fa24@syzkaller.appspotmail.com
First crash: 73d, last: 35d
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [bluetooth?] KMSAN: uninit-value in hci_cmd_complete_evt 0 (1) 2024/11/16 13:13

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in hci_cmd_complete_evt+0xd7b/0xeb0 net/bluetooth/hci_event.c:4226
 hci_cmd_complete_evt+0xd7b/0xeb0 net/bluetooth/hci_event.c:4226
 hci_event_func net/bluetooth/hci_event.c:7470 [inline]
 hci_event_packet+0x11df/0x1c20 net/bluetooth/hci_event.c:7525
 hci_rx_work+0x699/0x1260 net/bluetooth/hci_core.c:4035
 process_one_work kernel/workqueue.c:3229 [inline]
 process_scheduled_works+0xae0/0x1c40 kernel/workqueue.c:3310
 worker_thread+0xea7/0x14f0 kernel/workqueue.c:3391
 kthread+0x3e2/0x540 kernel/kthread.c:389
 ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Uninit was stored to memory at:
 hci_cmd_complete_evt+0xaf4/0xeb0
 hci_event_func net/bluetooth/hci_event.c:7470 [inline]
 hci_event_packet+0x11df/0x1c20 net/bluetooth/hci_event.c:7525
 hci_rx_work+0x699/0x1260 net/bluetooth/hci_core.c:4035
 process_one_work kernel/workqueue.c:3229 [inline]
 process_scheduled_works+0xae0/0x1c40 kernel/workqueue.c:3310
 worker_thread+0xea7/0x14f0 kernel/workqueue.c:3391
 kthread+0x3e2/0x540 kernel/kthread.c:389
 ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Uninit was created at:
 slab_post_alloc_hook mm/slub.c:4125 [inline]
 slab_alloc_node mm/slub.c:4168 [inline]
 kmem_cache_alloc_node_noprof+0x907/0xe00 mm/slub.c:4220
 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:587
 __alloc_skb+0x363/0x7b0 net/core/skbuff.c:678
 alloc_skb include/linux/skbuff.h:1323 [inline]
 bt_skb_alloc include/net/bluetooth/bluetooth.h:495 [inline]
 vhci_get_user drivers/bluetooth/hci_vhci.c:487 [inline]
 vhci_write+0x127/0x900 drivers/bluetooth/hci_vhci.c:607
 new_sync_write fs/read_write.c:586 [inline]
 vfs_write+0xb2b/0x1540 fs/read_write.c:679
 ksys_write+0x240/0x4b0 fs/read_write.c:731
 __do_sys_write fs/read_write.c:742 [inline]
 __se_sys_write fs/read_write.c:739 [inline]
 __x64_sys_write+0x93/0xe0 fs/read_write.c:739
 x64_sys_call+0x3161/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 0 UID: 0 PID: 5788 Comm: kworker/u9:4 Not tainted 6.13.0-rc3-syzkaller-00136-g8faabc041a00 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024
Workqueue: hci1 hci_rx_work
=====================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/12/20 15:40 upstream 8faabc041a00 1d58202c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in hci_cmd_complete_evt
2024/11/12 13:07 upstream 2d5404caa8c7 75bb1b32 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in hci_cmd_complete_evt
* Struck through repros no longer work on HEAD.