KMSAN: uninit-value in batadv_interface_tx (2)

Status: auto-closed as invalid on 2020/11/22 02:35
Subsystems: batman
[Documentation on labels]
Reported-by: syzbot+24458cef7d37351dd0c3@syzkaller.appspotmail.com
First crash: 2374d, last: 2198d
▶ ▼ Duplicate bugs (1)
Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
KMSAN: uninit-value in batadv_bla_tx batman 7 syz, C 13 2196d 2373d 0/29 closed as dup on 2020/01/31 19:23
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
KMSAN: uninit-value in batadv_bla_tx 1 (2) 2020/01/31 19:22
KMSAN: uninit-value in batadv_interface_tx (2) 1 (2) 2020/01/31 07:17
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in batadv_interface_tx (3) batman 7 syz, C 9 135d 196d 0/29 closed as invalid on 2026/04/08 13:13
upstream KMSAN: uninit-value in batadv_interface_tx batman 7 syz, C 98 2705d 2727d 11/29 fixed on 2019/03/06 07:43

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in batadv_interface_tx+0x10cf/0x2450 net/batman-adv/soft-interface.c:265
CPU: 1 PID: 16 Comm: ksoftirqd/1 Not tainted 5.8.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1df/0x240 lib/dump_stack.c:118
 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:121
 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215
 batadv_interface_tx+0x10cf/0x2450 net/batman-adv/soft-interface.c:265
 __netdev_start_xmit include/linux/netdevice.h:4611 [inline]
 netdev_start_xmit include/linux/netdevice.h:4625 [inline]
 xmit_one net/core/dev.c:3556 [inline]
 dev_hard_start_xmit+0x50e/0xa70 net/core/dev.c:3572
 __dev_queue_xmit+0x2f8d/0x3b20 net/core/dev.c:4131
 dev_queue_xmit+0x4b/0x60 net/core/dev.c:4164
 hsr_xmit net/hsr/hsr_forward.c:228 [inline]
 hsr_forward_do net/hsr/hsr_forward.c:285 [inline]
 hsr_forward_skb+0x1f07/0x31f0 net/hsr/hsr_forward.c:361
 hsr_handle_frame+0x3be/0x500 net/hsr/hsr_slave.c:44
 __netif_receive_skb_core+0x213f/0x5890 net/core/dev.c:5175
 __netif_receive_skb_one_core net/core/dev.c:5279 [inline]
 __netif_receive_skb net/core/dev.c:5395 [inline]
 process_backlog+0x605/0x14e0 net/core/dev.c:6239
 napi_poll net/core/dev.c:6684 [inline]
 net_rx_action+0x746/0x1aa0 net/core/dev.c:6752
 __do_softirq+0x311/0x83d kernel/softirq.c:293
 run_ksoftirqd+0x25/0x40 kernel/softirq.c:634
 smpboot_thread_fn+0x493/0x980 kernel/smpboot.c:165
 kthread+0x515/0x550 kernel/kthread.c:292
 ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:293

Uninit was stored to memory at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:144 [inline]
 kmsan_internal_chain_origin+0xad/0x130 mm/kmsan/kmsan.c:310
 kmsan_memcpy_memmove_metadata+0x272/0x2e0 mm/kmsan/kmsan.c:247
 kmsan_memcpy_metadata+0xb/0x10 mm/kmsan/kmsan.c:267
 __msan_memcpy+0x43/0x50 mm/kmsan/kmsan_instr.c:116
 pskb_expand_head+0x38b/0x1b00 net/core/skbuff.c:1636
 __skb_pad+0x47f/0x900 net/core/skbuff.c:1804
 __skb_put_padto include/linux/skbuff.h:3218 [inline]
 skb_put_padto include/linux/skbuff.h:3237 [inline]
 send_hsr_supervision_frame+0x122d/0x1500 net/hsr/hsr_device.c:299
 hsr_announce+0x1e2/0x370 net/hsr/hsr_device.c:330
 call_timer_fn+0x218/0x510 kernel/time/timer.c:1404
 expire_timers kernel/time/timer.c:1449 [inline]
 __run_timers+0xd20/0x11c0 kernel/time/timer.c:1773
 run_timer_softirq+0x2d/0x50 kernel/time/timer.c:1786
 __do_softirq+0x311/0x83d kernel/softirq.c:293

Uninit was created at:
 kmsan_save_stack_with_flags+0x3c/0x90 mm/kmsan/kmsan.c:144
 kmsan_internal_alloc_meta_for_pages mm/kmsan/kmsan_shadow.c:269 [inline]
 kmsan_alloc_page+0xb9/0x180 mm/kmsan/kmsan_shadow.c:293
 __alloc_pages_nodemask+0x56a2/0x5dc0 mm/page_alloc.c:4889
 __alloc_pages include/linux/gfp.h:509 [inline]
 __alloc_pages_node include/linux/gfp.h:522 [inline]
 alloc_pages_node include/linux/gfp.h:536 [inline]
 __page_frag_cache_refill mm/page_alloc.c:4964 [inline]
 page_frag_alloc+0x3ae/0x910 mm/page_alloc.c:4994
 __netdev_alloc_skb+0x703/0xbb0 net/core/skbuff.c:456
 __netdev_alloc_skb_ip_align include/linux/skbuff.h:2826 [inline]
 netdev_alloc_skb_ip_align include/linux/skbuff.h:2836 [inline]
 batadv_iv_ogm_aggregate_new net/batman-adv/bat_iv_ogm.c:558 [inline]
 batadv_iv_ogm_queue_add+0x10da/0x1900 net/batman-adv/bat_iv_ogm.c:670
 batadv_iv_ogm_schedule_buff net/batman-adv/bat_iv_ogm.c:833 [inline]
 batadv_iv_ogm_schedule+0xd63/0x1430 net/batman-adv/bat_iv_ogm.c:869
 batadv_iv_send_outstanding_bat_ogm_packet+0xbae/0xd50 net/batman-adv/bat_iv_ogm.c:1722
 process_one_work+0x1540/0x1f30 kernel/workqueue.c:2269
 worker_thread+0xed2/0x23f0 kernel/workqueue.c:2415
 kthread+0x515/0x550 kernel/kthread.c:292
 ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:293
=====================================================

Crashes (19):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/07/25 02:35 https://github.com/google/kmsan.git master 93f54a72361a 554af388 .config console log report ci-upstream-kmsan-gce
2020/07/05 13:53 https://github.com/google/kmsan.git master f0d5ec902b23 51095195 .config console log report ci-upstream-kmsan-gce
2020/06/30 17:51 https://github.com/google/kmsan.git master f0d5ec902b23 a2cdad9d .config console log report ci-upstream-kmsan-gce
2020/06/20 03:22 https://github.com/google/kmsan.git master f0d5ec902b23 81abc331 .config console log report ci-upstream-kmsan-gce
2020/06/02 00:58 https://github.com/google/kmsan.git master f0d5ec902b23 a0331e89 .config console log report ci-upstream-kmsan-gce
2020/06/01 06:36 https://github.com/google/kmsan.git master f0d5ec902b23 a0331e89 .config console log report ci-upstream-kmsan-gce
2020/06/01 00:13 https://github.com/google/kmsan.git master f0d5ec902b23 a0331e89 .config console log report ci-upstream-kmsan-gce
2020/05/07 03:36 https://github.com/google/kmsan.git master 21c44613a2fe 4618eb2d .config console log report ci-upstream-kmsan-gce
2020/04/19 19:08 https://github.com/google/kmsan.git master 5356842da2b5 6dfd45e1 .config console log report ci-upstream-kmsan-gce
2020/04/02 08:10 https://github.com/google/kmsan.git master 75303409203b a34e2c33 .config console log report ci-upstream-kmsan-gce
2020/03/30 00:51 https://github.com/google/kmsan.git master 75303409203b 05736b29 .config console log report ci-upstream-kmsan-gce
2020/03/21 16:26 https://github.com/google/kmsan.git master a58741ac26cc 4288d95e .config console log report ci-upstream-kmsan-gce
2020/03/21 16:16 https://github.com/google/kmsan.git master a58741ac26cc 4288d95e .config console log report ci-upstream-kmsan-gce
2020/03/16 09:28 https://github.com/google/kmsan.git master 8bbbc5cf3dca 749688d2 .config console log report ci-upstream-kmsan-gce
2020/02/13 20:35 https://github.com/google/kmsan.git master 686a4f77cb0c c5ed587f .config console log report ci-upstream-kmsan-gce
2020/01/30 16:46 https://github.com/google/kmsan.git master 686a4f77cb0c 5ed23f9a .config console log report ci-upstream-kmsan-gce
2020/03/27 02:12 https://github.com/google/kmsan.git master c95d0c951e03 6d25c5a0 .config console log report ci-upstream-kmsan-gce-386
2020/03/21 16:36 https://github.com/google/kmsan.git master a58741ac26cc 4288d95e .config console log report ci-upstream-kmsan-gce-386
2020/03/21 16:14 https://github.com/google/kmsan.git master a58741ac26cc 4288d95e .config console log report ci-upstream-kmsan-gce-386
* Struck through repros no longer work on HEAD.