syzbot

 sign-in | mailing list | source | docs
🐞 Open [955] ≡ Subsystems 🐞 Fixed [4575] 🐞 Invalid [10562] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

KMSAN: uninit-value in __netif_receive_skb_core

Status: upstream: reported C repro on 2018/04/12 08:01
Labels: net (incorrect?)
Reported-by: syzbot+b202b7208664142954fa@syzkaller.appspotmail.com
First crash: 1889d, last: 356d
▶ ▼ Discussions (3)
Title Replies (including bot) Last reply
Reminder: 99 open syzbot bugs in net subsystem 14 (14) 2019/07/31 15:13
Reminder: 94 open syzbot bugs in net subsystem 1 (1) 2019/06/25 05:48
KMSAN: uninit-value in __netif_receive_skb_core 3 (5) 2018/04/13 08:31
▶ ▼ Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 KASAN: use-after-free Read in __netif_receive_skb_core syz error 20 434d 975d 0/1 upstream: reported syz repro on 2020/10/08 04:31
upstream KASAN: null-ptr-deref Read in __netif_receive_skb_core wireguard 8 124d 402d 0/24 auto-obsoleted due to no activity on 2023/05/19 08:04
linux-4.14 KASAN: use-after-free Read in __netif_receive_skb_core syz error 19 702d 1120d 0/1 upstream: reported syz repro on 2020/05/16 19:24
▶ ▼ Last patch testing requests (11)
Created Duration User Patch Repo Result
2023/04/19 11:40 15m retest repro https://github.com/google/kmsan.git master error
2023/04/19 07:40 21m retest repro https://github.com/google/kmsan.git master report log
2023/04/19 04:40 21m retest repro https://github.com/google/kmsan.git master report log
2023/04/18 15:40 21m retest repro https://github.com/google/kmsan.git master report log
2023/04/18 14:40 30m retest repro https://github.com/google/kmsan.git master report log
2023/01/09 08:32 16m retest repro https://github.com/google/kmsan.git master error
2023/01/09 04:31 21m retest repro https://github.com/google/kmsan.git master report log
2023/01/08 18:31 21m retest repro https://github.com/google/kmsan.git master report log
2023/01/08 14:31 21m retest repro https://github.com/google/kmsan.git master report log
2023/01/08 12:31 21m retest repro https://github.com/google/kmsan.git master report log
2021/03/29 16:39 20m alaaemadhossney.ae@gmail.com https://github.com/google/kmsan.git master report log

Sample crash report:
device nr0 entered promiscuous mode
=====================================================
BUG: KMSAN: uninit-value in __netif_receive_skb_core+0x3547/0x51a0 net/core/dev.c:4852
CPU: 0 PID: 11272 Comm: syz-executor796 Not tainted 5.4.0-rc8-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c9/0x220 lib/dump_stack.c:118
 kmsan_report+0x128/0x220 mm/kmsan/kmsan_report.c:108
 __msan_warning+0x64/0xc0 mm/kmsan/kmsan_instr.c:245
 __netif_receive_skb_core+0x3547/0x51a0 net/core/dev.c:4852
 __netif_receive_skb_one_core net/core/dev.c:4927 [inline]
 __netif_receive_skb net/core/dev.c:5043 [inline]
 netif_receive_skb_internal+0x3cc/0xc20 net/core/dev.c:5133
 netif_receive_skb+0x1da/0x3a0 net/core/dev.c:5192
 tun_rx_batched drivers/net/tun.c:1553 [inline]
 tun_get_user+0x6d8c/0x70c0 drivers/net/tun.c:1993
 tun_chr_write_iter+0x1f2/0x360 drivers/net/tun.c:2022
 call_write_iter include/linux/fs.h:1895 [inline]
 new_sync_write fs/read_write.c:483 [inline]
 __vfs_write+0xa2c/0xcb0 fs/read_write.c:496
 vfs_write+0x481/0x920 fs/read_write.c:558
 ksys_write+0x265/0x430 fs/read_write.c:611
 __do_sys_write fs/read_write.c:623 [inline]
 __se_sys_write+0x92/0xb0 fs/read_write.c:620
 __x64_sys_write+0x4a/0x70 fs/read_write.c:620
 do_syscall_64+0xb6/0x160 arch/x86/entry/common.c:291
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x441799
Code: e8 ac e8 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb 08 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffdcabedfc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441799
RDX: 000000000000fdef RSI: 00000000200000c0 RDI: 0000000000000003
RBP: 0000000000000000 R08: 00000000004025a0 R09: 00000000004025a0
R10: 00000000004025a0 R11: 0000000000000246 R12: 0000000000402510
R13: 00000000004025a0 R14: 0000000000000000 R15: 0000000000000000

Uninit was stored to memory at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:149 [inline]
 kmsan_internal_chain_origin+0xbd/0x180 mm/kmsan/kmsan.c:317
 __msan_chain_origin+0x5c/0xc0 mm/kmsan/kmsan_instr.c:179
 vlan_set_encap_proto include/linux/skbuff.h:1600 [inline]
 skb_vlan_untag+0x6bc/0xd20 net/core/skbuff.c:5329
 __netif_receive_skb_core+0x833/0x51a0 net/core/dev.c:4774
 __netif_receive_skb_one_core net/core/dev.c:4927 [inline]
 __netif_receive_skb net/core/dev.c:5043 [inline]
 netif_receive_skb_internal+0x3cc/0xc20 net/core/dev.c:5133
 netif_receive_skb+0x1da/0x3a0 net/core/dev.c:5192
 tun_rx_batched drivers/net/tun.c:1553 [inline]
 tun_get_user+0x6d8c/0x70c0 drivers/net/tun.c:1993
 tun_chr_write_iter+0x1f2/0x360 drivers/net/tun.c:2022
 call_write_iter include/linux/fs.h:1895 [inline]
 new_sync_write fs/read_write.c:483 [inline]
 __vfs_write+0xa2c/0xcb0 fs/read_write.c:496
 vfs_write+0x481/0x920 fs/read_write.c:558
 ksys_write+0x265/0x430 fs/read_write.c:611
 __do_sys_write fs/read_write.c:623 [inline]
 __se_sys_write+0x92/0xb0 fs/read_write.c:620
 __x64_sys_write+0x4a/0x70 fs/read_write.c:620
 do_syscall_64+0xb6/0x160 arch/x86/entry/common.c:291
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:149 [inline]
 kmsan_internal_poison_shadow+0x60/0x120 mm/kmsan/kmsan.c:132
 kmsan_slab_alloc+0x97/0x100 mm/kmsan/kmsan_hooks.c:86
 slab_alloc_node mm/slub.c:2773 [inline]
 __kmalloc_node_track_caller+0xe27/0x11a0 mm/slub.c:4381
 __kmalloc_reserve net/core/skbuff.c:141 [inline]
 __alloc_skb+0x306/0xa10 net/core/skbuff.c:209
 alloc_skb include/linux/skbuff.h:1049 [inline]
 alloc_skb_with_frags+0x18c/0xa80 net/core/skbuff.c:5662
 sock_alloc_send_pskb+0xafd/0x10a0 net/core/sock.c:2244
 tun_alloc_skb drivers/net/tun.c:1529 [inline]
 tun_get_user+0x125e/0x70c0 drivers/net/tun.c:1843
 tun_chr_write_iter+0x1f2/0x360 drivers/net/tun.c:2022
 call_write_iter include/linux/fs.h:1895 [inline]
 new_sync_write fs/read_write.c:483 [inline]
 __vfs_write+0xa2c/0xcb0 fs/read_write.c:496
 vfs_write+0x481/0x920 fs/read_write.c:558
 ksys_write+0x265/0x430 fs/read_write.c:611
 __do_sys_write fs/read_write.c:623 [inline]
 __se_sys_write+0x92/0xb0 fs/read_write.c:620
 __x64_sys_write+0x4a/0x70 fs/read_write.c:620
 do_syscall_64+0xb6/0x160 arch/x86/entry/common.c:291
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
=====================================================

Crashes (343):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Manager Title
2019/11/24 18:44 https://github.com/google/kmsan.git master 4a1d41e39c62 598ca6c8 .config console log report syz C ci-upstream-kmsan-gce
2019/11/18 17:37 https://github.com/google/kmsan.git master 9c6a71628ab9 1daed50a .config console log report syz C ci-upstream-kmsan-gce
2019/10/25 07:02 https://github.com/google/kmsan.git master d86c15562d02 d01bb02a .config console log report syz C ci-upstream-kmsan-gce
2019/10/13 21:47 https://github.com/google/kmsan.git master fa1690255288 2f661ec4 .config console log report syz C ci-upstream-kmsan-gce
2018/04/13 05:09 https://github.com/google/kmsan.git master 35ff515e4bda eb2295de .config console log report syz C ci-upstream-kmsan-gce
2019/09/28 00:55 https://github.com/google/kmsan.git master 9baf75aa4188 d8074e0b .config console log report syz ci-upstream-kmsan-gce
2022/06/18 22:11 https://github.com/google/kmsan.git master fb61e40b30d1 8f633d84 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in __netif_receive_skb_core
2020/09/11 04:37 https://github.com/google/kmsan.git master 3b3ea6028136 409809d8 .config console log report ci-upstream-kmsan-gce
2020/09/10 06:01 https://github.com/google/kmsan.git master 3b3ea6028136 409809d8 .config console log report ci-upstream-kmsan-gce
2020/09/07 06:57 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce
2020/09/02 07:05 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce
2020/09/01 14:19 https://github.com/google/kmsan.git master 3b3ea6028136 d5a3ae1f .config console log report ci-upstream-kmsan-gce
2020/08/31 09:58 https://github.com/google/kmsan.git master 3b3ea6028136 d5a3ae1f .config console log report ci-upstream-kmsan-gce
2020/08/29 03:08 https://github.com/google/kmsan.git master 3b3ea6028136 d5a3ae1f .config console log report ci-upstream-kmsan-gce
2020/08/27 21:58 https://github.com/google/kmsan.git master ce8056d1f79e 816e0689 .config console log report ci-upstream-kmsan-gce
2020/08/22 11:06 https://github.com/google/kmsan.git master ce8056d1f79e 6436ce4b .config console log report ci-upstream-kmsan-gce
2020/08/20 11:16 https://github.com/google/kmsan.git master ce8056d1f79e ed282a3a .config console log report ci-upstream-kmsan-gce
2020/08/19 23:16 https://github.com/google/kmsan.git master ce8056d1f79e 94b45706 .config console log report ci-upstream-kmsan-gce
2020/08/19 20:48 https://github.com/google/kmsan.git master ce8056d1f79e 94b45706 .config console log report ci-upstream-kmsan-gce
2020/08/17 16:50 https://github.com/google/kmsan.git master ce8056d1f79e 424dd8e7 .config console log report ci-upstream-kmsan-gce
2020/07/28 21:58 https://github.com/google/kmsan.git master 93f54a72361a cb93dc6a .config console log report ci-upstream-kmsan-gce
2020/07/26 04:47 https://github.com/google/kmsan.git master 93f54a72361a 1f7cc1ca .config console log report ci-upstream-kmsan-gce
2020/07/23 00:43 https://github.com/google/kmsan.git master 93f54a72361a 340ea530 .config console log report ci-upstream-kmsan-gce
2020/07/20 10:16 https://github.com/google/kmsan.git master 14525656779e 9c812472 .config console log report ci-upstream-kmsan-gce
2020/07/15 00:05 https://github.com/google/kmsan.git master f0d5ec902b23 609fb517 .config console log report ci-upstream-kmsan-gce
2020/07/11 18:34 https://github.com/google/kmsan.git master f0d5ec902b23 18d18b59 .config console log report ci-upstream-kmsan-gce
2020/07/06 23:12 https://github.com/google/kmsan.git master f0d5ec902b23 51095195 .config console log report ci-upstream-kmsan-gce
2020/06/30 09:12 https://github.com/google/kmsan.git master f0d5ec902b23 a2cdad9d .config console log report ci-upstream-kmsan-gce
2020/06/27 22:49 https://github.com/google/kmsan.git master f0d5ec902b23 ffec44b5 .config console log report ci-upstream-kmsan-gce
2020/06/21 21:44 https://github.com/google/kmsan.git master f0d5ec902b23 4f2acff9 .config console log report ci-upstream-kmsan-gce
2020/06/19 11:04 https://github.com/google/kmsan.git master f0d5ec902b23 bc258b50 .config console log report ci-upstream-kmsan-gce
2020/06/18 03:52 https://github.com/google/kmsan.git master f0d5ec902b23 b9f3810b .config console log report ci-upstream-kmsan-gce
2020/06/11 10:16 https://github.com/google/kmsan.git master f0d5ec902b23 3ab7a05a .config console log report ci-upstream-kmsan-gce
2020/06/06 16:32 https://github.com/google/kmsan.git master f0d5ec902b23 e6b89e4e .config console log report ci-upstream-kmsan-gce
2020/06/06 08:11 https://github.com/google/kmsan.git master f0d5ec902b23 e6b89e4e .config console log report ci-upstream-kmsan-gce
2020/06/03 14:27 https://github.com/google/kmsan.git master f0d5ec902b23 a5ce5de0 .config console log report ci-upstream-kmsan-gce
2020/06/02 14:32 https://github.com/google/kmsan.git master f0d5ec902b23 52fd7b7d .config console log report ci-upstream-kmsan-gce
2020/06/01 18:11 https://github.com/google/kmsan.git master f0d5ec902b23 a0331e89 .config console log report ci-upstream-kmsan-gce
2020/05/31 14:38 https://github.com/google/kmsan.git master f0d5ec902b23 a0331e89 .config console log report ci-upstream-kmsan-gce
2018/04/08 07:48 https://github.com/google/kmsan.git master e2ab7e8abba4 66f22a7f .config console log report ci-upstream-kmsan-gce
2020/09/11 12:53 https://github.com/google/kmsan.git master 3b3ea6028136 adfb8b4e .config console log report ci-upstream-kmsan-gce-386
2020/09/05 12:22 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce-386
2020/09/05 07:35 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce-386
2020/08/27 16:36 https://github.com/google/kmsan.git master ce8056d1f79e 816e0689 .config console log report ci-upstream-kmsan-gce-386
2020/08/20 01:25 https://github.com/google/kmsan.git master ce8056d1f79e 94b45706 .config console log report ci-upstream-kmsan-gce-386
2020/08/15 09:10 https://github.com/google/kmsan.git master ce8056d1f79e 424dd8e7 .config console log report ci-upstream-kmsan-gce-386
2020/08/04 23:56 https://github.com/google/kmsan.git master 93f54a72361a 80a06902 .config console log report ci-upstream-kmsan-gce-386
2020/08/04 07:03 https://github.com/google/kmsan.git master 93f54a72361a 196277c4 .config console log report ci-upstream-kmsan-gce-386
2020/07/23 02:03 https://github.com/google/kmsan.git master 93f54a72361a 340ea530 .config console log report ci-upstream-kmsan-gce-386
2020/06/09 23:09 https://github.com/google/kmsan.git master f0d5ec902b23 092934c1 .config console log report ci-upstream-kmsan-gce-386
2020/06/06 19:20 https://github.com/google/kmsan.git master f0d5ec902b23 e6b89e4e .config console log report ci-upstream-kmsan-gce-386
* Struck through repros no longer work on HEAD.