KMSAN: uninit-value in ieee80211_rx_handlers

Status: fixed on 2023/10/12 12:47
Subsystems: wireless
[Documentation on labels]
Reported-by: syzbot+be9c824e6f269d608288@syzkaller.appspotmail.com
Fix commit: 19e4a47ee747 wifi: mac80211: check S1G action frame size
First crash: 1122d, last: 1063d
▶ ▼ Discussions (6)
Title Replies (including bot) Last reply
[PATCH AUTOSEL 5.15 11/15] wifi: mac80211: check S1G action frame size 1 (1) 2023/09/08 18:19
[PATCH AUTOSEL 6.1 19/26] wifi: mac80211: check S1G action frame size 1 (1) 2023/09/08 18:17
[PATCH AUTOSEL 6.4 29/41] wifi: mac80211: check S1G action frame size 1 (1) 2023/09/08 18:15
[PATCH AUTOSEL 6.5 32/45] wifi: mac80211: check S1G action frame size 1 (1) 2023/09/08 18:13
[PATCH] wifi: mac80211: check S1G action frame size 1 (1) 2023/08/15 15:51
[syzbot] [wireless?] KMSAN: uninit-value in ieee80211_rx_handlers 0 (2) 2023/07/30 12:06
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in ieee80211_rx_handlers (2) wireless 7 C 4 833d 852d 25/29 fixed on 2024/05/22 23:46
upstream general protection fault in ieee80211_rx_handlers wireless 2 1 1269d 1265d 0/29 auto-obsoleted due to no activity on 2023/04/03 21:09

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in ieee80211_rx_h_action net/mac80211/rx.c:3735 [inline]
BUG: KMSAN: uninit-value in ieee80211_rx_handlers+0xc12c/0x10c00 net/mac80211/rx.c:4129
 ieee80211_rx_h_action net/mac80211/rx.c:3735 [inline]
 ieee80211_rx_handlers+0xc12c/0x10c00 net/mac80211/rx.c:4129
 ieee80211_invoke_rx_handlers net/mac80211/rx.c:4164 [inline]
 ieee80211_prepare_and_rx_handle+0x563e/0x9640 net/mac80211/rx.c:5006
 ieee80211_rx_for_interface+0x88d/0x990 net/mac80211/rx.c:5091
 __ieee80211_rx_handle_packet net/mac80211/rx.c:5248 [inline]
 ieee80211_rx_list+0x5753/0x6580 net/mac80211/rx.c:5383
 ieee80211_rx_napi+0x87/0x350 net/mac80211/rx.c:5406
 ieee80211_rx include/net/mac80211.h:4949 [inline]
 ieee80211_tasklet_handler+0x1a0/0x310 net/mac80211/main.c:316
 tasklet_action_common+0x391/0xd30 kernel/softirq.c:780
 tasklet_action+0x26/0x30 kernel/softirq.c:805
 __do_softirq+0x1b7/0x78f kernel/softirq.c:553
 do_softirq+0x9a/0xf0 kernel/softirq.c:454
 __local_bh_enable_ip+0x99/0xa0 kernel/softirq.c:381
 local_bh_enable+0x28/0x30 include/linux/bottom_half.h:33
 __ieee80211_tx_skb_tid_band+0x276/0x560 net/mac80211/tx.c:6060
 ieee80211_tx_skb_tid+0x203/0x290 net/mac80211/tx.c:6087
 ieee80211_mgmt_tx+0x1cff/0x2070 net/mac80211/offchannel.c:965
 rdev_mgmt_tx net/wireless/rdev-ops.h:758 [inline]
 cfg80211_mlme_mgmt_tx+0x133b/0x1ba0 net/wireless/mlme.c:815
 nl80211_tx_mgmt+0x1297/0x1840 net/wireless/nl80211.c:12633
 genl_family_rcv_msg_doit net/netlink/genetlink.c:970 [inline]
 genl_family_rcv_msg net/netlink/genetlink.c:1050 [inline]
 genl_rcv_msg+0x1328/0x13c0 net/netlink/genetlink.c:1067
 netlink_rcv_skb+0x371/0x650 net/netlink/af_netlink.c:2549
 genl_rcv+0x40/0x60 net/netlink/genetlink.c:1078
 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
 netlink_unicast+0xf28/0x1230 net/netlink/af_netlink.c:1365
 netlink_sendmsg+0x122f/0x13d0 net/netlink/af_netlink.c:1914
 sock_sendmsg_nosec net/socket.c:725 [inline]
 sock_sendmsg net/socket.c:748 [inline]
 ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2494
 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2548
 __sys_sendmsg net/socket.c:2577 [inline]
 __do_sys_sendmsg net/socket.c:2586 [inline]
 __se_sys_sendmsg net/socket.c:2584 [inline]
 __x64_sys_sendmsg+0x307/0x490 net/socket.c:2584
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Uninit was stored to memory at:
 skb_copy_from_linear_data_offset include/linux/skbuff.h:4068 [inline]
 skb_copy_bits+0x149/0xd30 net/core/skbuff.c:2744
 skb_copy+0x47f/0xa00 net/core/skbuff.c:1936
 mac80211_hwsim_tx_frame_no_nl+0x18db/0x2130 drivers/net/wireless/virtual/mac80211_hwsim.c:1836
 mac80211_hwsim_tx+0x1baa/0x2ce0 drivers/net/wireless/virtual/mac80211_hwsim.c:2054
 drv_tx net/mac80211/driver-ops.h:37 [inline]
 ieee80211_tx_frags+0x5e7/0xd90 net/mac80211/tx.c:1737
 __ieee80211_tx+0x46e/0x630 net/mac80211/tx.c:1791
 ieee80211_tx+0x52e/0x570 net/mac80211/tx.c:1971
 ieee80211_xmit+0x54a/0x5b0 net/mac80211/tx.c:2063
 __ieee80211_tx_skb_tid_band+0x271/0x560 net/mac80211/tx.c:6059
 ieee80211_tx_skb_tid+0x203/0x290 net/mac80211/tx.c:6087
 ieee80211_mgmt_tx+0x1cff/0x2070 net/mac80211/offchannel.c:965
 rdev_mgmt_tx net/wireless/rdev-ops.h:758 [inline]
 cfg80211_mlme_mgmt_tx+0x133b/0x1ba0 net/wireless/mlme.c:815
 nl80211_tx_mgmt+0x1297/0x1840 net/wireless/nl80211.c:12633
 genl_family_rcv_msg_doit net/netlink/genetlink.c:970 [inline]
 genl_family_rcv_msg net/netlink/genetlink.c:1050 [inline]
 genl_rcv_msg+0x1328/0x13c0 net/netlink/genetlink.c:1067
 netlink_rcv_skb+0x371/0x650 net/netlink/af_netlink.c:2549
 genl_rcv+0x40/0x60 net/netlink/genetlink.c:1078
 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
 netlink_unicast+0xf28/0x1230 net/netlink/af_netlink.c:1365
 netlink_sendmsg+0x122f/0x13d0 net/netlink/af_netlink.c:1914
 sock_sendmsg_nosec net/socket.c:725 [inline]
 sock_sendmsg net/socket.c:748 [inline]
 ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2494
 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2548
 __sys_sendmsg net/socket.c:2577 [inline]
 __do_sys_sendmsg net/socket.c:2586 [inline]
 __se_sys_sendmsg net/socket.c:2584 [inline]
 __x64_sys_sendmsg+0x307/0x490 net/socket.c:2584
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Uninit was created at:
 slab_post_alloc_hook+0x12f/0xb70 mm/slab.h:767
 slab_alloc_node mm/slub.c:3470 [inline]
 kmem_cache_alloc_node+0x577/0xa80 mm/slub.c:3515
 kmalloc_reserve+0x148/0x470 net/core/skbuff.c:559
 __alloc_skb+0x318/0x740 net/core/skbuff.c:644
 __netdev_alloc_skb+0x11a/0x6f0 net/core/skbuff.c:708
 netdev_alloc_skb include/linux/skbuff.h:3212 [inline]
 dev_alloc_skb include/linux/skbuff.h:3225 [inline]
 ieee80211_mgmt_tx+0x1316/0x2070 net/mac80211/offchannel.c:907
 rdev_mgmt_tx net/wireless/rdev-ops.h:758 [inline]
 cfg80211_mlme_mgmt_tx+0x133b/0x1ba0 net/wireless/mlme.c:815
 nl80211_tx_mgmt+0x1297/0x1840 net/wireless/nl80211.c:12633
 genl_family_rcv_msg_doit net/netlink/genetlink.c:970 [inline]
 genl_family_rcv_msg net/netlink/genetlink.c:1050 [inline]
 genl_rcv_msg+0x1328/0x13c0 net/netlink/genetlink.c:1067
 netlink_rcv_skb+0x371/0x650 net/netlink/af_netlink.c:2549
 genl_rcv+0x40/0x60 net/netlink/genetlink.c:1078
 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
 netlink_unicast+0xf28/0x1230 net/netlink/af_netlink.c:1365
 netlink_sendmsg+0x122f/0x13d0 net/netlink/af_netlink.c:1914
 sock_sendmsg_nosec net/socket.c:725 [inline]
 sock_sendmsg net/socket.c:748 [inline]
 ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2494
 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2548
 __sys_sendmsg net/socket.c:2577 [inline]
 __do_sys_sendmsg net/socket.c:2586 [inline]
 __se_sys_sendmsg net/socket.c:2584 [inline]
 __x64_sys_sendmsg+0x307/0x490 net/socket.c:2584
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

CPU: 1 PID: 4993 Comm: syz-executor798 Not tainted 6.5.0-rc3-syzkaller-00283-g12214540ad87 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023
=====================================================

Crashes (8):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/07/30 12:06 upstream 12214540ad87 92476829 .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce KMSAN: uninit-value in ieee80211_rx_handlers
2023/08/28 04:04 upstream 85eb043618bb 03d9c195 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in ieee80211_rx_handlers
2023/08/26 21:47 upstream 7d2f353b2682 03d9c195 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in ieee80211_rx_handlers
2023/08/21 00:29 upstream b320441c04c9 d216d8a0 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in ieee80211_rx_handlers
2023/08/04 08:26 upstream 7bafbd4027ae 74621247 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce KMSAN: uninit-value in ieee80211_rx_handlers
2023/07/31 20:18 upstream 5d0c230f1de8 2a0d0f29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce KMSAN: uninit-value in ieee80211_rx_handlers
2023/07/30 09:19 upstream 12214540ad87 92476829 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce KMSAN: uninit-value in ieee80211_rx_handlers
2023/06/29 10:24 https://github.com/google/kmsan.git master 257152fe29be ca69c785 .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in ieee80211_rx_handlers
* Struck through repros no longer work on HEAD.