syzbot


KMSAN: uninit-value in iptable_mangle_hook (5)

Status: auto-closed as invalid on 2021/11/12 20:56
Subsystems: netfilter
[Documentation on labels]
Reported-by: syzbot+9b5e12c49c015d4c1aeb@syzkaller.appspotmail.com
First crash: 1133d, last: 1008d
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] KMSAN: uninit-value in iptable_mangle_hook (5) 0 (1) 2021/03/17 05:49
Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in iptable_mangle_hook (3) netfilter 5 1975d 2093d 0/26 auto-closed as invalid on 2019/05/20 19:01
upstream KMSAN: uninit-value in iptable_mangle_hook netfilter C 1134 2173d 2204d 5/26 fixed on 2018/05/08 18:30
upstream KMSAN: uninit-value in iptable_mangle_hook (4) netfilter syz 128 1139d 1595d 0/26 closed as invalid on 2021/03/12 07:36
upstream KMSAN: kernel-infoleak in _copy_to_iter (7) net C 138977 420d 772d 22/26 fixed on 2023/02/24 13:50

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in ipt_mangle_out net/ipv4/netfilter/iptable_mangle.c:61 [inline]
BUG: KMSAN: uninit-value in iptable_mangle_hook+0x75a/0x8c0 net/ipv4/netfilter/iptable_mangle.c:81
CPU: 0 PID: 16635 Comm: syz-executor.3 Not tainted 5.12.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x24c/0x2e0 lib/dump_stack.c:120
 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:121
 __msan_warning+0x5c/0xa0 mm/kmsan/kmsan_instr.c:197
 ipt_mangle_out net/ipv4/netfilter/iptable_mangle.c:61 [inline]
 iptable_mangle_hook+0x75a/0x8c0 net/ipv4/netfilter/iptable_mangle.c:81
 nf_hook_entry_hookfn include/linux/netfilter.h:136 [inline]
 nf_hook_slow+0x17b/0x460 net/netfilter/core.c:589
 nf_hook include/linux/netfilter.h:256 [inline]
 __ip_local_out+0x78c/0x840 net/ipv4/ip_output.c:115
 ip_local_out+0xa1/0x1e0 net/ipv4/ip_output.c:124
 iptunnel_xmit+0x931/0xf20 net/ipv4/ip_tunnel_core.c:82
 udp_tunnel_xmit_skb+0x526/0x640 net/ipv4/udp_tunnel_core.c:174
 geneve_xmit_skb drivers/net/geneve.c:959 [inline]
 geneve_xmit+0x2139/0x3c40 drivers/net/geneve.c:1059
 __netdev_start_xmit include/linux/netdevice.h:4825 [inline]
 netdev_start_xmit include/linux/netdevice.h:4839 [inline]
 __dev_direct_xmit+0x9bc/0xcb0 net/core/dev.c:4262
 dev_direct_xmit include/linux/netdevice.h:2873 [inline]
 packet_direct_xmit+0x329/0x540 net/packet/af_packet.c:244
 packet_snd net/packet/af_packet.c:3006 [inline]
 packet_sendmsg+0x86ee/0x99d0 net/packet/af_packet.c:3031
 sock_sendmsg_nosec net/socket.c:654 [inline]
 sock_sendmsg net/socket.c:674 [inline]
 __sys_sendto+0x9ea/0xc60 net/socket.c:1977
 __do_sys_sendto net/socket.c:1989 [inline]
 __se_sys_sendto+0x107/0x130 net/socket.c:1985
 __x64_sys_sendto+0x6e/0x90 net/socket.c:1985
 do_syscall_64+0x9f/0x140 arch/x86/entry/common.c:48
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x4665d9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3d0fb22188 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665d9
RDX: 000000000000000e RSI: 0000000020000140 RDI: 0000000000000003
RBP: 00000000004bfcb9 R08: 0000000020000040 R09: 0000000000000014
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80
R13: 0000000000a9fb1f R14: 00007f3d0fb22300 R15: 0000000000022000

Uninit was stored to memory at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:120 [inline]
 kmsan_internal_chain_origin+0xad/0x130 mm/kmsan/kmsan.c:288
 __msan_chain_origin+0x54/0xa0 mm/kmsan/kmsan_instr.c:147
 iptunnel_xmit+0xbd6/0xf20 net/ipv4/ip_tunnel_core.c:76
 udp_tunnel_xmit_skb+0x526/0x640 net/ipv4/udp_tunnel_core.c:174
 geneve_xmit_skb drivers/net/geneve.c:959 [inline]
 geneve_xmit+0x2139/0x3c40 drivers/net/geneve.c:1059
 __netdev_start_xmit include/linux/netdevice.h:4825 [inline]
 netdev_start_xmit include/linux/netdevice.h:4839 [inline]
 __dev_direct_xmit+0x9bc/0xcb0 net/core/dev.c:4262
 dev_direct_xmit include/linux/netdevice.h:2873 [inline]
 packet_direct_xmit+0x329/0x540 net/packet/af_packet.c:244
 packet_snd net/packet/af_packet.c:3006 [inline]
 packet_sendmsg+0x86ee/0x99d0 net/packet/af_packet.c:3031
 sock_sendmsg_nosec net/socket.c:654 [inline]
 sock_sendmsg net/socket.c:674 [inline]
 __sys_sendto+0x9ea/0xc60 net/socket.c:1977
 __do_sys_sendto net/socket.c:1989 [inline]
 __se_sys_sendto+0x107/0x130 net/socket.c:1985
 __x64_sys_sendto+0x6e/0x90 net/socket.c:1985
 do_syscall_64+0x9f/0x140 arch/x86/entry/common.c:48
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:120 [inline]
 kmsan_internal_poison_shadow+0x66/0xd0 mm/kmsan/kmsan.c:103
 kmsan_slab_alloc+0x8e/0xe0 mm/kmsan/kmsan_hooks.c:76
 slab_alloc_node mm/slub.c:2922 [inline]
 __kmalloc_node_track_caller+0xa4f/0x1470 mm/slub.c:4609
 kmalloc_reserve net/core/skbuff.c:353 [inline]
 __alloc_skb+0x4dd/0xe90 net/core/skbuff.c:424
 alloc_skb include/linux/skbuff.h:1103 [inline]
 alloc_skb_with_frags+0x1f3/0xc10 net/core/skbuff.c:5948
 sock_alloc_send_pskb+0xdc1/0xf90 net/core/sock.c:2362
 packet_alloc_skb net/packet/af_packet.c:2854 [inline]
 packet_snd net/packet/af_packet.c:2949 [inline]
 packet_sendmsg+0x6a12/0x99d0 net/packet/af_packet.c:3031
 sock_sendmsg_nosec net/socket.c:654 [inline]
 sock_sendmsg net/socket.c:674 [inline]
 __sys_sendto+0x9ea/0xc60 net/socket.c:1977
 __do_sys_sendto net/socket.c:1989 [inline]
 __se_sys_sendto+0x107/0x130 net/socket.c:1985
 __x64_sys_sendto+0x6e/0x90 net/socket.c:1985
 do_syscall_64+0x9f/0x140 arch/x86/entry/common.c:48
 entry_SYSCALL_64_after_hwframe+0x44/0xae
=====================================================

Crashes (51):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/07/15 19:58 https://github.com/google/kmsan.git master 57b5797c8013 b9a2f64e .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in iptable_mangle_hook
2021/07/15 06:54 https://github.com/google/kmsan.git master 57b5797c8013 b9a2f64e .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in iptable_mangle_hook
2021/07/15 00:18 https://github.com/google/kmsan.git master 57b5797c8013 94e0b707 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in iptable_mangle_hook
2021/07/11 02:57 https://github.com/google/kmsan.git master 57b5797c8013 8f5a7b8c .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in iptable_mangle_hook
2021/07/03 20:42 https://github.com/google/kmsan.git master 57b5797c8013 55aa55c2 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in iptable_mangle_hook
2021/06/30 07:34 https://github.com/google/kmsan.git master 57b5797c8013 a4fccb01 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in iptable_mangle_hook
2021/06/26 12:06 https://github.com/google/kmsan.git master 57b5797c8013 9d2ab5df .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in iptable_mangle_hook
2021/06/18 09:36 https://github.com/google/kmsan.git master bfeba8b4c158 aba2b2fb .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in iptable_mangle_hook
2021/06/17 16:06 https://github.com/google/kmsan.git master 89a0faf20faa aba2b2fb .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in iptable_mangle_hook
2021/06/17 16:03 https://github.com/google/kmsan.git master 89a0faf20faa aba2b2fb .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in iptable_mangle_hook
2021/06/15 18:47 https://github.com/google/kmsan.git master 7bcc9a7be76b 58636922 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in iptable_mangle_hook
2021/06/05 08:32 https://github.com/google/kmsan.git master 6099c9da2f7d 500c2339 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in iptable_mangle_hook
2021/05/31 00:37 https://github.com/google/kmsan.git master 6099c9da2f7d 325a8dab .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in iptable_mangle_hook
2021/05/29 13:45 https://github.com/google/kmsan.git master 6099c9da2f7d 858ea628 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in iptable_mangle_hook
2021/05/23 16:57 https://github.com/google/kmsan.git master 6099c9da2f7d 3c7fef33 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in iptable_mangle_hook
2021/05/23 02:48 https://github.com/google/kmsan.git master 6099c9da2f7d 3c7fef33 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in iptable_mangle_hook
2021/05/23 02:38 https://github.com/google/kmsan.git master 6099c9da2f7d 3c7fef33 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in iptable_mangle_hook
2021/05/20 14:52 https://github.com/google/kmsan.git master 6099c9da2f7d c560a65d .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in iptable_mangle_hook
2021/05/20 14:52 https://github.com/google/kmsan.git master 6099c9da2f7d c560a65d .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in iptable_mangle_hook
2021/05/20 07:14 https://github.com/google/kmsan.git master 6099c9da2f7d a343ba6b .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in iptable_mangle_hook
2021/05/12 13:19 https://github.com/google/kmsan.git master bdefec9ab855 da958a4d .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in iptable_mangle_hook
2021/05/10 17:53 https://github.com/google/kmsan.git master 4ebaab5fb428 ca873091 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in iptable_mangle_hook
2021/05/07 12:52 https://github.com/google/kmsan.git master 4ebaab5fb428 f6da8120 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in iptable_mangle_hook
2021/05/02 06:07 https://github.com/google/kmsan.git master 4ebaab5fb428 77e2b668 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in iptable_mangle_hook
2021/04/30 17:33 https://github.com/google/kmsan.git master 4ebaab5fb428 77e2b668 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in iptable_mangle_hook
2021/04/29 02:05 https://github.com/google/kmsan.git master 4ebaab5fb428 77e2b668 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in iptable_mangle_hook
2021/04/23 03:23 https://github.com/google/kmsan.git master 4ebaab5fb428 590921a5 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in iptable_mangle_hook
2021/04/02 09:46 https://github.com/google/kmsan.git master 29ad81a1074a 6a81331a .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in iptable_mangle_hook
2021/03/16 06:49 https://github.com/google/kmsan.git master 29ad81a1074a fdb2bb2c .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in iptable_mangle_hook
2021/03/12 20:32 https://github.com/google/kmsan.git master 29ad81a1074a 429d8a6b .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in iptable_mangle_hook
2021/07/13 06:22 https://github.com/google/kmsan.git master 57b5797c8013 f415556d .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in iptable_mangle_hook
2021/06/30 06:35 https://github.com/google/kmsan.git master 57b5797c8013 a4fccb01 .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in iptable_mangle_hook
2021/06/28 16:59 https://github.com/google/kmsan.git master 57b5797c8013 9d2ab5df .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in iptable_mangle_hook
2021/06/22 23:42 https://github.com/google/kmsan.git master 6a6a67f21dec aba2b2fb .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in iptable_mangle_hook
2021/06/17 16:16 https://github.com/google/kmsan.git master 89a0faf20faa aba2b2fb .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in iptable_mangle_hook
2021/06/17 16:06 https://github.com/google/kmsan.git master 89a0faf20faa aba2b2fb .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in iptable_mangle_hook
2021/06/04 07:56 https://github.com/google/kmsan.git master 6099c9da2f7d 0740de69 .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in iptable_mangle_hook
2021/05/31 00:26 https://github.com/google/kmsan.git master 6099c9da2f7d 325a8dab .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in iptable_mangle_hook
2021/05/29 13:53 https://github.com/google/kmsan.git master 6099c9da2f7d 858ea628 .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in iptable_mangle_hook
2021/05/28 00:27 https://github.com/google/kmsan.git master 6099c9da2f7d 858ea628 .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in iptable_mangle_hook
2021/05/25 08:08 https://github.com/google/kmsan.git master 6099c9da2f7d 3c7fef33 .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in iptable_mangle_hook
2021/05/23 02:47 https://github.com/google/kmsan.git master 6099c9da2f7d 3c7fef33 .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in iptable_mangle_hook
2021/04/29 01:58 https://github.com/google/kmsan.git master 4ebaab5fb428 77e2b668 .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in iptable_mangle_hook
2021/03/26 11:36 https://github.com/google/kmsan.git master 29ad81a1074a 6a383ecf .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in iptable_mangle_hook
2021/03/20 01:14 https://github.com/google/kmsan.git master 29ad81a1074a 2af9d324 .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in iptable_mangle_hook
* Struck through repros no longer work on HEAD.