syzbot

 sign-in | mailing list | source | docs
🐞 Open [988] ≡ Subsystems 🐞 Fixed [5242] 🐞 Invalid [12509] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

KMSAN: uninit-value in __ip_select_ident (2)

Status: auto-closed as invalid on 2020/03/09 13:54
Subsystems: net
[Documentation on labels]
First crash: 1954d, last: 1598d
▶ ▼ Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in __ip_select_ident net 14 2059d 2137d 0/26 closed as invalid on 2018/09/21 18:23

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in __read_once_size include/linux/compiler.h:206 [inline]
BUG: KMSAN: uninit-value in ip_idents_reserve net/ipv4/route.c:490 [inline]
BUG: KMSAN: uninit-value in __ip_select_ident+0x34f/0x640 net/ipv4/route.c:520
CPU: 0 PID: 593 Comm: syz-executor.4 Not tainted 5.4.0-rc8-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c9/0x220 lib/dump_stack.c:118
 kmsan_report+0x128/0x220 mm/kmsan/kmsan_report.c:108
 __msan_warning+0x57/0xa0 mm/kmsan/kmsan_instr.c:245
 __read_once_size include/linux/compiler.h:206 [inline]
 ip_idents_reserve net/ipv4/route.c:490 [inline]
 __ip_select_ident+0x34f/0x640 net/ipv4/route.c:520
 iptunnel_xmit+0x821/0xde0 net/ipv4/ip_tunnel_core.c:76
 ip_tunnel_xmit+0x2d74/0x33c0 net/ipv4/ip_tunnel.c:818
 __gre_xmit net/ipv4/ip_gre.c:444 [inline]
 ipgre_xmit+0xff3/0x1120 net/ipv4/ip_gre.c:628
 __netdev_start_xmit include/linux/netdevice.h:4413 [inline]
 netdev_start_xmit include/linux/netdevice.h:4427 [inline]
 xmit_one net/core/dev.c:3199 [inline]
 dev_hard_start_xmit+0x51a/0xab0 net/core/dev.c:3215
 __dev_queue_xmit+0x35b6/0x4200 net/core/dev.c:3792
 dev_queue_xmit+0x4b/0x60 net/core/dev.c:3825
 packet_snd net/packet/af_packet.c:2959 [inline]
 packet_sendmsg+0x8301/0x9230 net/packet/af_packet.c:2984
 sock_sendmsg_nosec net/socket.c:637 [inline]
 sock_sendmsg net/socket.c:657 [inline]
 ___sys_sendmsg+0x14ff/0x1590 net/socket.c:2311
 __sys_sendmsg net/socket.c:2356 [inline]
 __do_sys_sendmsg net/socket.c:2365 [inline]
 __se_sys_sendmsg+0x305/0x460 net/socket.c:2363
 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2363
 do_syscall_64+0xb6/0x160 arch/x86/entry/common.c:291
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45a6f9
Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fc597c68c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a6f9
RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000000004
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc597c696d4
R13: 00000000004c97b2 R14: 00000000004e1550 R15: 00000000ffffffff

Uninit was stored to memory at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:149 [inline]
 kmsan_internal_chain_origin+0xb9/0x170 mm/kmsan/kmsan.c:317
 __msan_chain_origin+0x4f/0xa0 mm/kmsan/kmsan_instr.c:179
 iptunnel_xmit+0xaf2/0xde0 net/ipv4/ip_tunnel_core.c:73
 ip_tunnel_xmit+0x2d74/0x33c0 net/ipv4/ip_tunnel.c:818
 __gre_xmit net/ipv4/ip_gre.c:444 [inline]
 ipgre_xmit+0xff3/0x1120 net/ipv4/ip_gre.c:628
 __netdev_start_xmit include/linux/netdevice.h:4413 [inline]
 netdev_start_xmit include/linux/netdevice.h:4427 [inline]
 xmit_one net/core/dev.c:3199 [inline]
 dev_hard_start_xmit+0x51a/0xab0 net/core/dev.c:3215
 __dev_queue_xmit+0x35b6/0x4200 net/core/dev.c:3792
 dev_queue_xmit+0x4b/0x60 net/core/dev.c:3825
 packet_snd net/packet/af_packet.c:2959 [inline]
 packet_sendmsg+0x8301/0x9230 net/packet/af_packet.c:2984
 sock_sendmsg_nosec net/socket.c:637 [inline]
 sock_sendmsg net/socket.c:657 [inline]
 ___sys_sendmsg+0x14ff/0x1590 net/socket.c:2311
 __sys_sendmsg net/socket.c:2356 [inline]
 __do_sys_sendmsg net/socket.c:2365 [inline]
 __se_sys_sendmsg+0x305/0x460 net/socket.c:2363
 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2363
 do_syscall_64+0xb6/0x160 arch/x86/entry/common.c:291
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Uninit was stored to memory at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:149 [inline]
 kmsan_internal_chain_origin+0xb9/0x170 mm/kmsan/kmsan.c:317
 __msan_chain_origin+0x4f/0xa0 mm/kmsan/kmsan_instr.c:179
 ip_tunnel_init_flow include/net/ip_tunnels.h:248 [inline]
 ip_tunnel_xmit+0xb3b/0x33c0 net/ipv4/ip_tunnel.c:735
 __gre_xmit net/ipv4/ip_gre.c:444 [inline]
 ipgre_xmit+0xff3/0x1120 net/ipv4/ip_gre.c:628
 __netdev_start_xmit include/linux/netdevice.h:4413 [inline]
 netdev_start_xmit include/linux/netdevice.h:4427 [inline]
 xmit_one net/core/dev.c:3199 [inline]
 dev_hard_start_xmit+0x51a/0xab0 net/core/dev.c:3215
 __dev_queue_xmit+0x35b6/0x4200 net/core/dev.c:3792
 dev_queue_xmit+0x4b/0x60 net/core/dev.c:3825
 packet_snd net/packet/af_packet.c:2959 [inline]
 packet_sendmsg+0x8301/0x9230 net/packet/af_packet.c:2984
 sock_sendmsg_nosec net/socket.c:637 [inline]
 sock_sendmsg net/socket.c:657 [inline]
 ___sys_sendmsg+0x14ff/0x1590 net/socket.c:2311
 __sys_sendmsg net/socket.c:2356 [inline]
 __do_sys_sendmsg net/socket.c:2365 [inline]
 __se_sys_sendmsg+0x305/0x460 net/socket.c:2363
 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2363
 do_syscall_64+0xb6/0x160 arch/x86/entry/common.c:291
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Uninit was stored to memory at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:149 [inline]
 kmsan_internal_chain_origin+0xb9/0x170 mm/kmsan/kmsan.c:317
 kmsan_memcpy_memmove_metadata+0x25c/0x2e0 mm/kmsan/kmsan.c:252
 kmsan_memcpy_metadata+0xb/0x10 mm/kmsan/kmsan.c:272
 __msan_memcpy+0x56/0x70 mm/kmsan/kmsan_instr.c:129
 pskb_expand_head+0x38a/0x19f0 net/core/skbuff.c:1637
 __skb_cow include/linux/skbuff.h:3118 [inline]
 skb_cow_head include/linux/skbuff.h:3152 [inline]
 ipgre_xmit+0x6d9/0x1120 net/ipv4/ip_gre.c:607
 __netdev_start_xmit include/linux/netdevice.h:4413 [inline]
 netdev_start_xmit include/linux/netdevice.h:4427 [inline]
 xmit_one net/core/dev.c:3199 [inline]
 dev_hard_start_xmit+0x51a/0xab0 net/core/dev.c:3215
 __dev_queue_xmit+0x35b6/0x4200 net/core/dev.c:3792
 dev_queue_xmit+0x4b/0x60 net/core/dev.c:3825
 packet_snd net/packet/af_packet.c:2959 [inline]
 packet_sendmsg+0x8301/0x9230 net/packet/af_packet.c:2984
 sock_sendmsg_nosec net/socket.c:637 [inline]
 sock_sendmsg net/socket.c:657 [inline]
 ___sys_sendmsg+0x14ff/0x1590 net/socket.c:2311
 __sys_sendmsg net/socket.c:2356 [inline]
 __do_sys_sendmsg net/socket.c:2365 [inline]
 __se_sys_sendmsg+0x305/0x460 net/socket.c:2363
 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2363
 do_syscall_64+0xb6/0x160 arch/x86/entry/common.c:291
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:149 [inline]
 kmsan_internal_poison_shadow+0x5c/0x110 mm/kmsan/kmsan.c:132
 kmsan_slab_alloc+0x8a/0xe0 mm/kmsan/kmsan_hooks.c:86
 slab_alloc_node mm/slub.c:2773 [inline]
 __kmalloc_node_track_caller+0xe47/0x11f0 mm/slub.c:4381
 __kmalloc_reserve net/core/skbuff.c:141 [inline]
 __alloc_skb+0x309/0xa50 net/core/skbuff.c:209
 alloc_skb include/linux/skbuff.h:1049 [inline]
 alloc_skb_with_frags+0x18c/0xa80 net/core/skbuff.c:5662
 sock_alloc_send_pskb+0xafd/0x10a0 net/core/sock.c:2244
 packet_alloc_skb net/packet/af_packet.c:2807 [inline]
 packet_snd net/packet/af_packet.c:2902 [inline]
 packet_sendmsg+0x641c/0x9230 net/packet/af_packet.c:2984
 sock_sendmsg_nosec net/socket.c:637 [inline]
 sock_sendmsg net/socket.c:657 [inline]
 ___sys_sendmsg+0x14ff/0x1590 net/socket.c:2311
 __sys_sendmsg net/socket.c:2356 [inline]
 __do_sys_sendmsg net/socket.c:2365 [inline]
 __se_sys_sendmsg+0x305/0x460 net/socket.c:2363
 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2363
 do_syscall_64+0xb6/0x160 arch/x86/entry/common.c:291
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
=====================================================

Crashes (28):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/12/10 13:45 https://github.com/google/kmsan.git master f8f75f037ea5 4b83c8fb .config console log report ci-upstream-kmsan-gce
2019/11/26 18:28 https://github.com/google/kmsan.git master df335139222b 1048481f .config console log report ci-upstream-kmsan-gce
2019/11/10 06:06 https://github.com/google/kmsan.git master e741088f2efa dc438b91 .config console log report ci-upstream-kmsan-gce
2019/11/09 03:23 https://github.com/google/kmsan.git master e741088f2efa dc438b91 .config console log report ci-upstream-kmsan-gce
2019/10/30 10:42 https://github.com/google/kmsan.git master 96c6c3194b1b 5ea87a66 .config console log report ci-upstream-kmsan-gce
2019/10/03 20:46 https://github.com/google/kmsan.git master 1e76a3e537c3 fc17ba49 .config console log report ci-upstream-kmsan-gce
2019/09/22 10:41 https://github.com/google/kmsan.git master cebbfdbcf2b7 d96e88f3 .config console log report ci-upstream-kmsan-gce
2019/09/22 09:57 https://github.com/google/kmsan.git master cebbfdbcf2b7 d96e88f3 .config console log report ci-upstream-kmsan-gce
2019/09/20 00:59 https://github.com/google/kmsan.git master cebbfdbcf2b7 4d3ae0b7 .config console log report ci-upstream-kmsan-gce
2019/09/17 21:14 https://github.com/google/kmsan.git master cebbfdbcf2b7 13dcda9b .config console log report ci-upstream-kmsan-gce
2019/09/08 04:14 https://github.com/google/kmsan.git master 014077b5cd62 a60cb4cd .config console log report ci-upstream-kmsan-gce
2019/09/07 10:56 https://github.com/google/kmsan.git master 014077b5cd62 a60cb4cd .config console log report ci-upstream-kmsan-gce
2019/08/19 07:43 https://github.com/google/kmsan.git master 61ccdad1fcdf b8ceabfc .config console log report ci-upstream-kmsan-gce
2019/08/11 03:42 https://github.com/google/kmsan.git master 61ccdad1fcdf acb51638 .config console log report ci-upstream-kmsan-gce
2019/08/07 03:55 https://github.com/google/kmsan.git master ae0c578a3cdf c6f01e54 .config console log report ci-upstream-kmsan-gce
2019/08/07 03:45 https://github.com/google/kmsan.git master ae0c578a3cdf c6f01e54 .config console log report ci-upstream-kmsan-gce
2019/08/06 09:51 https://github.com/google/kmsan.git master ae0c578a3cdf 6affd8e8 .config console log report ci-upstream-kmsan-gce
2019/05/10 08:54 https://github.com/google/kmsan.git master d062d017e907 018207ef .config console log report ci-upstream-kmsan-gce
2019/04/25 09:22 https://github.com/google/kmsan.git master 199a02db1f61 8e3c52b1 .config console log report ci-upstream-kmsan-gce
2019/04/22 07:26 https://github.com/google/kmsan.git master 199a02db1f61 b0e8efcb .config console log report ci-upstream-kmsan-gce
2019/04/15 15:03 https://github.com/google/kmsan.git master 199a02db1f61 505ab413 .config console log report ci-upstream-kmsan-gce
2019/04/06 21:44 https://github.com/google/kmsan.git master 46200eb9666d c34fde03 .config console log report ci-upstream-kmsan-gce
2019/04/05 21:10 https://github.com/google/kmsan.git master 46200eb9666d 40f2363e .config console log report ci-upstream-kmsan-gce
2019/04/05 18:34 https://github.com/google/kmsan.git master 46200eb9666d 40f2363e .config console log report ci-upstream-kmsan-gce
2019/03/29 10:36 https://github.com/google/kmsan.git master 088c01ea0855 98c1bf1c .config console log report ci-upstream-kmsan-gce
2019/01/16 19:00 https://github.com/google/kmsan.git master 02f2d5aea531 d538790b .config console log report ci-upstream-kmsan-gce
2019/01/08 03:42 https://github.com/google/kmsan.git master 48128c3ca084 69d69aa9 .config console log report ci-upstream-kmsan-gce
2018/12/20 07:36 https://github.com/google/kmsan.git master 49d30e29c6d8 02e69052 .config console log report ci-upstream-kmsan-gce
* Struck through repros no longer work on HEAD.