syzbot


KMSAN: uninit-value in __sctp_v6_cmp_addr (2)

Status: upstream: reported C repro on 2025/08/26 14:11
Subsystems: sctp
[Documentation on labels]
Reported-by: syzbot+e69f06a0f30116c68056@syzkaller.appspotmail.com
Fix commit: sctp: initialize more fields in sctp_v6_from_sk()
Patched on: [ci-upstream-net-this-kasan-gce], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-rust-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 3d21h, last: 2d18h
Discussions (2)
Title Replies (including bot) Last reply
[PATCH net] sctp: initialize more fields in sctp_v6_from_sk() 3 (3) 2025/08/28 00:30
[syzbot] [sctp?] KMSAN: uninit-value in __sctp_v6_cmp_addr (2) 0 (1) 2025/08/26 14:11
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in __sctp_v6_cmp_addr sctp 7 C 1109 2661d 2662d 5/29 fixed on 2018/05/16 20:41
Last patch testing requests (1)
Created Duration User Patch Repo Result
2025/08/26 07:13 1h13m edumazet@google.com patch upstream OK log

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649
 __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649
 sctp_inet6_cmp_addr+0x4f2/0x510 net/sctp/ipv6.c:983
 sctp_bind_addr_conflict+0x22a/0x3b0 net/sctp/bind_addr.c:390
 sctp_get_port_local+0x21eb/0x2440 net/sctp/socket.c:8452
 sctp_get_port net/sctp/socket.c:8523 [inline]
 sctp_listen_start net/sctp/socket.c:8567 [inline]
 sctp_inet_listen+0x710/0xfd0 net/sctp/socket.c:8636
 __sys_listen_socket net/socket.c:1912 [inline]
 __sys_listen net/socket.c:1927 [inline]
 __do_sys_listen net/socket.c:1932 [inline]
 __se_sys_listen net/socket.c:1930 [inline]
 __x64_sys_listen+0x343/0x4c0 net/socket.c:1930
 x64_sys_call+0x271d/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:51
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Local variable t.i created at:
 __do_sys_futex kernel/futex/syscalls.c:165 [inline]
 __se_sys_futex+0x4d/0x740 kernel/futex/syscalls.c:160
 __x64_sys_futex+0x114/0x1a0 kernel/futex/syscalls.c:160

CPU: 1 UID: 0 PID: 6089 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(none) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
=====================================================

Crashes (9):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/08/25 13:39 upstream 69fd6b99b8f8 bf27483f .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in __sctp_v6_cmp_addr
2025/08/25 10:51 upstream 69fd6b99b8f8 bf27483f .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in __sctp_v6_cmp_addr
2025/08/25 09:27 upstream 69fd6b99b8f8 bf27483f .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in __sctp_v6_cmp_addr
2025/08/25 08:06 upstream 69fd6b99b8f8 bf27483f .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in __sctp_v6_cmp_addr
2025/08/25 06:04 upstream 69fd6b99b8f8 bf27483f .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in __sctp_v6_cmp_addr
2025/08/24 23:03 upstream 69fd6b99b8f8 bf27483f .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in __sctp_v6_cmp_addr
2025/08/24 20:31 upstream 69fd6b99b8f8 bf27483f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in __sctp_v6_cmp_addr
2025/08/25 23:15 upstream b6add54ba618 bf27483f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in __sctp_v6_cmp_addr
2025/08/25 23:15 upstream b6add54ba618 bf27483f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in __sctp_v6_cmp_addr
* Struck through repros no longer work on HEAD.