KMSAN: uninit-value in macvlan_broadcast (2)

Status: fixed on 2026/08/28 09:06
Subsystems: net
Labels: prio:low
[Documentation on labels]
Fix commit: 12bec2bd4b76 bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb
First crash: 151d, last: 76d
✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
84b9b81d assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ KMSAN: uninit-value in macvlan_broadcast (2) 2026/05/31 13:11 2026/05/31 13:11 2026/05/31 13:58 6b4a8443
6d281f31 assessment-security 💥 KMSAN: uninit-value in macvlan_broadcast (2) 2026/05/14 16:51 2026/05/14 16:51 2026/05/14 16:52 6ccb967e
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in macvlan_broadcast net 7 syz, C 2 2425d 2425d 15/29 fixed on 2020/02/18 14:31
Last patch testing requests (3)
Created Duration User Patch Repo Result
2026/06/30 19:26 2h21m retest repro upstream error
2026/04/19 18:34 45m retest repro upstream report log
2026/04/19 18:28 35m retest repro upstream report log

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in variable_test_bit arch/x86/include/asm/bitops.h:222 [inline]
BUG: KMSAN: uninit-value in arch_test_bit arch/x86/include/asm/bitops.h:233 [inline]
BUG: KMSAN: uninit-value in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:142 [inline]
BUG: KMSAN: uninit-value in macvlan_broadcast+0x47b/0xac0 drivers/net/macvlan.c:284
 variable_test_bit arch/x86/include/asm/bitops.h:222 [inline]
 arch_test_bit arch/x86/include/asm/bitops.h:233 [inline]
 _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:142 [inline]
 macvlan_broadcast+0x47b/0xac0 drivers/net/macvlan.c:284
 macvlan_queue_xmit drivers/net/macvlan.c:549 [inline]
 macvlan_start_xmit+0x38b/0x940 drivers/net/macvlan.c:587
 __netdev_start_xmit include/linux/netdevice.h:5325 [inline]
 netdev_start_xmit include/linux/netdevice.h:5334 [inline]
 xmit_one net/core/dev.c:3888 [inline]
 dev_hard_start_xmit+0x24e/0xad0 net/core/dev.c:3904
 __dev_queue_xmit+0x3412/0x5980 net/core/dev.c:4854
 dev_queue_xmit include/linux/netdevice.h:3385 [inline]
 __bpf_tx_skb net/core/filter.c:2152 [inline]
 __bpf_redirect_common net/core/filter.c:2196 [inline]
 __bpf_redirect+0x162e/0x1760 net/core/filter.c:2203
 ____bpf_clone_redirect net/core/filter.c:2493 [inline]
 bpf_clone_redirect+0x4a6/0x6c0 net/core/filter.c:2456
 ___bpf_prog_run+0x13e8/0xea90 kernel/bpf/core.c:2067
 __bpf_prog_run32+0xc2/0xf0 kernel/bpf/core.c:2361
 bpf_dispatcher_nop_func include/linux/bpf.h:1402 [inline]
 __bpf_prog_run include/linux/filter.h:712 [inline]
 bpf_prog_run include/linux/filter.h:730 [inline]
 bpf_test_run+0x846/0xdf0 net/bpf/test_run.c:423
 bpf_prog_test_run_skb+0x22a5/0x3050 net/bpf/test_run.c:1159
 bpf_prog_test_run+0x5bb/0x9f0 kernel/bpf/syscall.c:4743
 __sys_bpf+0x925/0xee0 kernel/bpf/syscall.c:6267
 __do_sys_bpf kernel/bpf/syscall.c:6362 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6360 [inline]
 __x64_sys_bpf+0xa4/0xf0 kernel/bpf/syscall.c:6360
 x64_sys_call+0x13d0/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:322
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x134/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
 mc_hash drivers/net/macvlan.c:260 [inline]
 macvlan_broadcast+0x474/0xac0 drivers/net/macvlan.c:283
 macvlan_queue_xmit drivers/net/macvlan.c:549 [inline]
 macvlan_start_xmit+0x38b/0x940 drivers/net/macvlan.c:587
 __netdev_start_xmit include/linux/netdevice.h:5325 [inline]
 netdev_start_xmit include/linux/netdevice.h:5334 [inline]
 xmit_one net/core/dev.c:3888 [inline]
 dev_hard_start_xmit+0x24e/0xad0 net/core/dev.c:3904
 __dev_queue_xmit+0x3412/0x5980 net/core/dev.c:4854
 dev_queue_xmit include/linux/netdevice.h:3385 [inline]
 __bpf_tx_skb net/core/filter.c:2152 [inline]
 __bpf_redirect_common net/core/filter.c:2196 [inline]
 __bpf_redirect+0x162e/0x1760 net/core/filter.c:2203
 ____bpf_clone_redirect net/core/filter.c:2493 [inline]
 bpf_clone_redirect+0x4a6/0x6c0 net/core/filter.c:2456
 ___bpf_prog_run+0x13e8/0xea90 kernel/bpf/core.c:2067
 __bpf_prog_run32+0xc2/0xf0 kernel/bpf/core.c:2361
 bpf_dispatcher_nop_func include/linux/bpf.h:1402 [inline]
 __bpf_prog_run include/linux/filter.h:712 [inline]
 bpf_prog_run include/linux/filter.h:730 [inline]
 bpf_test_run+0x846/0xdf0 net/bpf/test_run.c:423
 bpf_prog_test_run_skb+0x22a5/0x3050 net/bpf/test_run.c:1159
 bpf_prog_test_run+0x5bb/0x9f0 kernel/bpf/syscall.c:4743
 __sys_bpf+0x925/0xee0 kernel/bpf/syscall.c:6267
 __do_sys_bpf kernel/bpf/syscall.c:6362 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6360 [inline]
 __x64_sys_bpf+0xa4/0xf0 kernel/bpf/syscall.c:6360
 x64_sys_call+0x13d0/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:322
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x134/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
 slab_post_alloc_hook mm/slub.c:4545 [inline]
 slab_alloc_node mm/slub.c:4866 [inline]
 kmem_cache_alloc_node_noprof+0x3cd/0x12d0 mm/slub.c:4918
 kmalloc_reserve net/core/skbuff.c:613 [inline]
 pskb_expand_head+0x2ef/0x1fb0 net/core/skbuff.c:2315
 skb_ensure_writable+0x44e/0x510 net/core/skbuff.c:6365
 __bpf_try_make_writable net/core/filter.c:1681 [inline]
 bpf_try_make_writable net/core/filter.c:1687 [inline]
 bpf_try_make_head_writable net/core/filter.c:1695 [inline]
 ____bpf_clone_redirect net/core/filter.c:2487 [inline]
 bpf_clone_redirect+0x301/0x6c0 net/core/filter.c:2456
 ___bpf_prog_run+0x13e8/0xea90 kernel/bpf/core.c:2067
 __bpf_prog_run32+0xc2/0xf0 kernel/bpf/core.c:2361
 bpf_dispatcher_nop_func include/linux/bpf.h:1402 [inline]
 __bpf_prog_run include/linux/filter.h:712 [inline]
 bpf_prog_run include/linux/filter.h:730 [inline]
 bpf_test_run+0x846/0xdf0 net/bpf/test_run.c:423
 bpf_prog_test_run_skb+0x22a5/0x3050 net/bpf/test_run.c:1159
 bpf_prog_test_run+0x5bb/0x9f0 kernel/bpf/syscall.c:4743
 __sys_bpf+0x925/0xee0 kernel/bpf/syscall.c:6267
 __do_sys_bpf kernel/bpf/syscall.c:6362 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6360 [inline]
 __x64_sys_bpf+0xa4/0xf0 kernel/bpf/syscall.c:6360
 x64_sys_call+0x13d0/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:322
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x134/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 0 UID: 0 PID: 6051 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
=====================================================

Crashes (9):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/04/05 15:04 upstream 3aae9383f42f 4440e7c2 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in macvlan_broadcast
2026/06/12 21:07 upstream 2b414a95b8f7 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in macvlan_broadcast
2026/06/09 04:08 upstream 4549871118cf 656e94c6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in macvlan_broadcast
2026/05/21 05:50 upstream df685633c3db 41b8c833 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in macvlan_broadcast
2026/04/05 07:11 upstream 3aae9383f42f 4440e7c2 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in macvlan_broadcast
2026/04/05 07:10 upstream 3aae9383f42f 4440e7c2 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in macvlan_broadcast
2026/04/03 19:16 upstream d8a9a4b11a13 4440e7c2 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in macvlan_broadcast
2026/04/03 19:16 upstream d8a9a4b11a13 4440e7c2 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in macvlan_broadcast
2026/03/29 19:17 upstream cbfffcca2bf0 356bdfc9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in macvlan_broadcast
* Struck through repros no longer work on HEAD.