syzbot


KMSAN: uninit-value in batadv_tt_hash_find

Status: fixed on 2020/09/25 01:17
Subsystems: batman
[Documentation on labels]
Reported-by: syzbot+ab16e463b903f5a37036@syzkaller.appspotmail.com
Fix commit: 303216e76dca batman-adv: Avoid uninitialized chaddr when handling DHCP
First crash: 1368d, last: 1311d
Discussions (8)
Title Replies (including bot) Last reply
[PATCH 4.4 00/62] 4.4.236-rc1 review 66 (66) 2020/09/12 08:08
[PATCH 4.9 00/71] 4.9.236-rc1 review 75 (75) 2020/09/12 08:06
[PATCH 5.8 000/186] 5.8.8-rc1 review 198 (198) 2020/09/10 13:47
[PATCH 5.4 000/129] 5.4.64-rc1 review 135 (135) 2020/09/09 16:40
[PATCH 4.14 00/65] 4.14.197-rc1 review 70 (70) 2020/09/09 16:39
[PATCH 4.19 00/88] 4.19.144-rc1 review 99 (99) 2020/09/09 16:39
[PATCH 0/3] pull request for net: batman-adv 2020-08-24 5 (5) 2020/08/25 01:17
KMSAN: uninit-value in batadv_tt_hash_find 0 (1) 2020/07/14 16:27
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in batadv_tt_hash_find (2) batman 1 826d 826d 0/26 auto-closed as invalid on 2022/04/07 21:37

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in batadv_tt_hash_find+0x368/0x8a0 net/batman-adv/translation-table.c:144
CPU: 0 PID: 1628 Comm: syz-executor.3 Not tainted 5.8.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x21c/0x280 lib/dump_stack.c:118
 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:121
 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215
 batadv_tt_hash_find+0x368/0x8a0 net/batman-adv/translation-table.c:144
 batadv_tt_global_hash_find net/batman-adv/translation-table.c:203 [inline]
 batadv_transtable_search+0x2b8/0xbb0 net/batman-adv/translation-table.c:2618
 batadv_send_skb_via_tt_generic+0x181/0x290 net/batman-adv/send.c:423
 batadv_send_skb_via_tt net/batman-adv/send.h:82 [inline]
 batadv_interface_tx+0x1b64/0x2970 net/batman-adv/soft-interface.c:379
 __netdev_start_xmit include/linux/netdevice.h:4611 [inline]
 netdev_start_xmit include/linux/netdevice.h:4625 [inline]
 xmit_one+0x3cf/0x750 net/core/dev.c:3556
 dev_hard_start_xmit net/core/dev.c:3572 [inline]
 __dev_queue_xmit+0x3aad/0x4470 net/core/dev.c:4131
 dev_queue_xmit+0x4b/0x60 net/core/dev.c:4164
 neigh_hh_output include/net/neighbour.h:498 [inline]
 neigh_output include/net/neighbour.h:507 [inline]
 ip_finish_output2+0x2443/0x2930 net/ipv4/ip_output.c:228
 ip_do_fragment+0x367f/0x3b50 net/ipv4/ip_output.c:849
 ip_fragment+0x341/0x4e0 net/ipv4/ip_output.c:585
 __ip_finish_output+0xf83/0xfd0 net/ipv4/ip_output.c:304
 ip_finish_output+0x14b/0x4b0 net/ipv4/ip_output.c:316
 NF_HOOK_COND include/linux/netfilter.h:296 [inline]
 ip_mc_output+0x10d9/0x1260 net/ipv4/ip_output.c:415
 dst_output include/net/dst.h:443 [inline]
 ip_local_out net/ipv4/ip_output.c:125 [inline]
 ip_send_skb+0x19a/0x3f0 net/ipv4/ip_output.c:1560
 udp_send_skb+0x130c/0x1bc0 net/ipv4/udp.c:894
 udp_sendmsg+0x4162/0x4980 net/ipv4/udp.c:1181
 inet_sendmsg+0x15b/0x1d0 net/ipv4/af_inet.c:814
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg net/socket.c:672 [inline]
 ____sys_sendmsg+0xc82/0x1240 net/socket.c:2352
 ___sys_sendmsg net/socket.c:2406 [inline]
 __sys_sendmmsg+0x808/0xf70 net/socket.c:2489
 __compat_sys_sendmmsg net/compat.c:480 [inline]
 __do_compat_sys_sendmmsg net/compat.c:487 [inline]
 __se_compat_sys_sendmmsg+0xcd/0xf0 net/compat.c:484
 __ia32_compat_sys_sendmmsg+0x56/0x70 net/compat.c:484
 do_syscall_32_irqs_on arch/x86/entry/common.c:430 [inline]
 __do_fast_syscall_32+0x2af/0x480 arch/x86/entry/common.c:477
 do_fast_syscall_32+0x6b/0xd0 arch/x86/entry/common.c:505
 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:554
 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c
RIP: 0023:0xf7f15549
Code: Bad RIP value.
RSP: 002b:00000000f550f0cc EFLAGS: 00000296 ORIG_RAX: 0000000000000159
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000020007f80
RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000

Local variable ----chaddr@batadv_interface_tx created at:
 batadv_interface_tx+0x66/0x2970 net/batman-adv/soft-interface.c:192
 batadv_interface_tx+0x66/0x2970 net/batman-adv/soft-interface.c:192
=====================================================

Crashes (11):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/09/09 11:31 https://github.com/google/kmsan.git master 3b3ea6028136 0ea7a887 .config console log report ci-upstream-kmsan-gce-386
2020/09/07 20:28 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce-386
2020/08/27 08:47 https://github.com/google/kmsan.git master ce8056d1f79e 816e0689 .config console log report ci-upstream-kmsan-gce-386
2020/08/22 21:23 https://github.com/google/kmsan.git master ce8056d1f79e 1da71ab0 .config console log report ci-upstream-kmsan-gce-386
2020/08/20 05:14 https://github.com/google/kmsan.git master ce8056d1f79e ed282a3a .config console log report ci-upstream-kmsan-gce-386
2020/08/11 09:09 https://github.com/google/kmsan.git master ce8056d1f79e bacaf5fa .config console log report ci-upstream-kmsan-gce-386
2020/08/06 01:09 https://github.com/google/kmsan.git master 93f54a72361a 0487ea6f .config console log report ci-upstream-kmsan-gce-386
2020/07/31 18:23 https://github.com/google/kmsan.git master 93f54a72361a d895b3be .config console log report ci-upstream-kmsan-gce-386
2020/07/29 09:13 https://github.com/google/kmsan.git master 93f54a72361a 19a8de55 .config console log report ci-upstream-kmsan-gce-386
2020/07/20 13:28 https://github.com/google/kmsan.git master 91e18444d6b0 4285ffa3 .config console log report ci-upstream-kmsan-gce-386
2020/07/14 05:49 https://github.com/google/kmsan.git master f0d5ec902b23 ce4c95b3 .config console log report ci-upstream-kmsan-gce-386
* Struck through repros no longer work on HEAD.