syzbot


KMSAN: uninit-value in netif_napi_del

Status: auto-obsoleted due to no activity on 2022/12/09 08:58
Subsystems: net
[Documentation on labels]
First crash: 1466d, last: 1356d
Last patch testing requests (4)
Created Duration User Patch Repo Result
2022/12/09 07:31 20m retest repro https://github.com/google/kmsan.git master OK log
2022/12/09 05:31 20m retest repro https://github.com/google/kmsan.git master OK log
2022/08/31 00:27 7m retest repro https://github.com/google/kmsan.git master error OK
2022/08/30 21:27 6m retest repro https://github.com/google/kmsan.git master error OK

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in __list_del_entry_valid+0x194/0x410 lib/list_debug.c:45
CPU: 1 PID: 11669 Comm: syz-executor.2 Not tainted 5.7.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c9/0x220 lib/dump_stack.c:118
 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:121
 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215
 __list_del_entry_valid+0x194/0x410 lib/list_debug.c:45
 __list_del_entry include/linux/list.h:132 [inline]
 list_del_init include/linux/list.h:204 [inline]
 netif_napi_del+0x292/0x1040 net/core/dev.c:6545
 free_netdev+0x300/0x5b0 net/core/dev.c:9910
 netdev_run_todo+0x1240/0x1570 net/core/dev.c:9659
 rtnl_unlock net/core/rtnetlink.c:112 [inline]
 rtnetlink_rcv_msg+0x11f8/0x1570 net/core/rtnetlink.c:5455
 netlink_rcv_skb+0x451/0x650 net/netlink/af_netlink.c:2469
 rtnetlink_rcv+0x50/0x60 net/core/rtnetlink.c:5472
 netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline]
 netlink_unicast+0xf9e/0x1100 net/netlink/af_netlink.c:1329
 netlink_sendmsg+0x1246/0x14d0 net/netlink/af_netlink.c:1918
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg net/socket.c:672 [inline]
 ____sys_sendmsg+0x12b6/0x1350 net/socket.c:2362
 ___sys_sendmsg net/socket.c:2416 [inline]
 __sys_sendmsg+0x623/0x750 net/socket.c:2449
 __compat_sys_sendmsg net/compat.c:658 [inline]
 __do_compat_sys_sendmsg net/compat.c:665 [inline]
 __se_compat_sys_sendmsg+0xa7/0xc0 net/compat.c:662
 __ia32_compat_sys_sendmsg+0x4a/0x70 net/compat.c:662
 do_syscall_32_irqs_on arch/x86/entry/common.c:339 [inline]
 do_fast_syscall_32+0x3bf/0x6d0 arch/x86/entry/common.c:398
 entry_SYSENTER_compat+0x68/0x77 arch/x86/entry/entry_64_compat.S:139
RIP: 0023:0xf7fdedd9
Code: 90 e8 0b 00 00 00 f3 90 0f ae e8 eb f9 8d 74 26 00 89 3c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 002b:00000000f7fb80cc EFLAGS: 00000296 ORIG_RAX: 0000000000000172
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000020000140
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:144 [inline]
 kmsan_internal_poison_shadow+0x66/0xd0 mm/kmsan/kmsan.c:127
 kmsan_slab_alloc+0x8a/0xe0 mm/kmsan/kmsan_hooks.c:80
 slab_alloc_node mm/slub.c:2802 [inline]
 __kmalloc_node_track_caller+0xb40/0x1200 mm/slub.c:4436
 __kmalloc_reserve net/core/skbuff.c:142 [inline]
 __alloc_skb+0x2fd/0xac0 net/core/skbuff.c:210
 alloc_skb include/linux/skbuff.h:1083 [inline]
 nlmsg_new include/net/netlink.h:888 [inline]
 rtmsg_ifinfo_build_skb+0x165/0x430 net/core/rtnetlink.c:3695
 rollback_registered_many+0x17dc/0x25f0 net/core/dev.c:8832
 rollback_registered net/core/dev.c:8873 [inline]
 unregister_netdevice_queue+0x58b/0xaa0 net/core/dev.c:9969
 unregister_netdevice include/linux/netdevice.h:2725 [inline]
 __tun_detach+0x2416/0x2dd0 drivers/net/tun.c:690
 tun_detach drivers/net/tun.c:707 [inline]
 tun_chr_close+0xda/0x1c0 drivers/net/tun.c:3413
 __fput+0x4b1/0xb80 fs/file_table.c:280
 ____fput+0x37/0x40 fs/file_table.c:313
 task_work_run+0x1ee/0x2d0 kernel/task_work.c:123
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_usermode_loop arch/x86/entry/common.c:165 [inline]
 prepare_exit_to_usermode+0x3c8/0x520 arch/x86/entry/common.c:196
 syscall_return_slowpath+0x95/0x5f0 arch/x86/entry/common.c:279
 do_syscall_32_irqs_on arch/x86/entry/common.c:342 [inline]
 do_fast_syscall_32+0x41a/0x6d0 arch/x86/entry/common.c:398
 entry_SYSENTER_compat+0x68/0x77 arch/x86/entry/entry_64_compat.S:139
=====================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/07/10 21:37 https://github.com/google/kmsan.git master f0d5ec902b23 edf162e8 .config console log report syz ci-upstream-kmsan-gce-386
2020/03/23 11:15 https://github.com/google/kmsan.git master a58741ac26cc 78267cec .config console log report syz ci-upstream-kmsan-gce-386
* Struck through repros no longer work on HEAD.