syzbot


KMSAN: uninit-value in icmpv6_rcv

Status: auto-closed as invalid on 2022/03/21 22:47
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 353d, last: 339d

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in __skb_checksum_validate_complete include/linux/skbuff.h:4128 [inline]
BUG: KMSAN: uninit-value in icmpv6_rcv+0x2075/0x2cf0 net/ipv6/icmp.c:904
 __skb_checksum_validate_complete include/linux/skbuff.h:4128 [inline]
 icmpv6_rcv+0x2075/0x2cf0 net/ipv6/icmp.c:904
 ip6_protocol_deliver_rcu+0xe7c/0x2ab0 net/ipv6/ip6_input.c:422
 ip6_input_finish net/ipv6/ip6_input.c:463 [inline]
 NF_HOOK include/linux/netfilter.h:307 [inline]
 ip6_input+0x130/0x390 net/ipv6/ip6_input.c:472
 ip6_mc_input+0xcab/0xef0 net/ipv6/ip6_input.c:566
 dst_input include/net/dst.h:460 [inline]
 ip6_rcv_finish+0x670/0x850 net/ipv6/ip6_input.c:76
 NF_HOOK include/linux/netfilter.h:307 [inline]
 ipv6_rcv+0x1d1/0x460 net/ipv6/ip6_input.c:297
 __netif_receive_skb_one_core net/core/dev.c:5465 [inline]
 __netif_receive_skb+0x1ec/0x630 net/core/dev.c:5579
 process_backlog+0x54b/0xc10 net/core/dev.c:6455
 __napi_poll+0x14c/0xc00 net/core/dev.c:7023
 napi_poll net/core/dev.c:7090 [inline]
 net_rx_action+0x7e2/0x1820 net/core/dev.c:7177
 __do_softirq+0x1ee/0x7c5 kernel/softirq.c:558
 run_ksoftirqd+0x33/0x50 kernel/softirq.c:921
 smpboot_thread_fn+0x606/0xbd0 kernel/smpboot.c:164
 kthread+0x721/0x850 kernel/kthread.c:327
 ret_from_fork+0x1f/0x30

Uninit was stored to memory at:
 __skb_postpull_rcsum include/linux/skbuff.h:3467 [inline]
 skb_postpull_rcsum include/linux/skbuff.h:3487 [inline]
 ip6_protocol_deliver_rcu+0x1b44/0x2ab0 net/ipv6/ip6_input.c:399
 ip6_input_finish net/ipv6/ip6_input.c:463 [inline]
 NF_HOOK include/linux/netfilter.h:307 [inline]
 ip6_input+0x130/0x390 net/ipv6/ip6_input.c:472
 ip6_mc_input+0xcab/0xef0 net/ipv6/ip6_input.c:566
 dst_input include/net/dst.h:460 [inline]
 ip6_rcv_finish+0x670/0x850 net/ipv6/ip6_input.c:76
 NF_HOOK include/linux/netfilter.h:307 [inline]
 ipv6_rcv+0x1d1/0x460 net/ipv6/ip6_input.c:297
 __netif_receive_skb_one_core net/core/dev.c:5465 [inline]
 __netif_receive_skb+0x1ec/0x630 net/core/dev.c:5579
 process_backlog+0x54b/0xc10 net/core/dev.c:6455
 __napi_poll+0x14c/0xc00 net/core/dev.c:7023
 napi_poll net/core/dev.c:7090 [inline]
 net_rx_action+0x7e2/0x1820 net/core/dev.c:7177
 __do_softirq+0x1ee/0x7c5 kernel/softirq.c:558

Uninit was created at:
 slab_post_alloc_hook mm/slab.h:524 [inline]
 slab_alloc_node mm/slub.c:3251 [inline]
 __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974
 kmalloc_reserve net/core/skbuff.c:354 [inline]
 __alloc_skb+0x545/0xf90 net/core/skbuff.c:426
 __netdev_alloc_skb+0x4b9/0x8c0 net/core/skbuff.c:494
 __netdev_alloc_skb_ip_align include/linux/skbuff.h:2934 [inline]
 netdev_alloc_skb_ip_align include/linux/skbuff.h:2944 [inline]
 br_ip6_multicast_alloc_query net/bridge/br_multicast.c:992 [inline]
 br_multicast_alloc_query net/bridge/br_multicast.c:1137 [inline]
 __br_multicast_send_query+0x1cdd/0x6680 net/bridge/br_multicast.c:1636
 br_multicast_send_query+0x9b7/0xb70 net/bridge/br_multicast.c:1725
 br_multicast_query_expired net/bridge/br_multicast.c:3811 [inline]
 br_ip6_multicast_query_expired+0x27f/0x310 net/bridge/br_multicast.c:3831
 call_timer_fn+0x81/0x540 kernel/time/timer.c:1421
 expire_timers+0x2f5/0x6d0 kernel/time/timer.c:1466
 __run_timers+0x66b/0x9f0 kernel/time/timer.c:1734
 run_timer_softirq+0x71/0xe0 kernel/time/timer.c:1747
 __do_softirq+0x1ee/0x7c5 kernel/softirq.c:558

CPU: 0 PID: 12 Comm: ksoftirqd/0 Not tainted 5.16.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
=====================================================

Crashes (2):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kmsan-gce-386 2021/12/21 22:40 https://github.com/google/kmsan.git master 81c325bbf94e a938f0b8 .config log report info KMSAN: uninit-value in icmpv6_rcv
ci-upstream-kmsan-gce-386 2021/12/08 07:19 https://github.com/google/kmsan.git master 8b936c96768e 0230ba3e .config log report info KMSAN: uninit-value in icmpv6_rcv
* Struck through repros no longer work on HEAD.