syzbot


KMSAN: uninit-value in pneigh_fill_info

Status: fixed on 2022/03/08 16:11
Subsystems: net
[Documentation on labels]
Fix commit: e195e9b5dee6 net, neigh: clear whole pneigh_entry at alloc time
First crash: 1101d, last: 1093d

Sample crash report:
netlink: 'syz-executor479': attribute type 12 has an invalid length.
=====================================================
BUG: KMSAN: uninit-value in pneigh_fill_info+0x986/0xb30 net/core/neighbour.c:2593
 pneigh_fill_info+0x986/0xb30 net/core/neighbour.c:2593
 pneigh_dump_table net/core/neighbour.c:2715 [inline]
 neigh_dump_info+0x1e3f/0x2c60 net/core/neighbour.c:2832
 netlink_dump+0xaca/0x16a0 net/netlink/af_netlink.c:2265
 __netlink_dump_start+0xd1c/0xee0 net/netlink/af_netlink.c:2370
 netlink_dump_start include/linux/netlink.h:254 [inline]
 rtnetlink_rcv_msg+0x181b/0x18c0 net/core/rtnetlink.c:5534
 netlink_rcv_skb+0x447/0x800 net/netlink/af_netlink.c:2491
 rtnetlink_rcv+0x50/0x60 net/core/rtnetlink.c:5589
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x1095/0x1360 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x16f3/0x1870 net/netlink/af_netlink.c:1916
 sock_sendmsg_nosec net/socket.c:704 [inline]
 sock_sendmsg net/socket.c:724 [inline]
 ____sys_sendmsg+0xe11/0x12c0 net/socket.c:2409
 ___sys_sendmsg net/socket.c:2463 [inline]
 __sys_sendmsg+0x4a5/0x640 net/socket.c:2492
 __do_sys_sendmsg net/socket.c:2501 [inline]
 __se_sys_sendmsg net/socket.c:2499 [inline]
 __x64_sys_sendmsg+0xe2/0x120 net/socket.c:2499
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Uninit was created at:
 slab_post_alloc_hook mm/slab.h:524 [inline]
 slab_alloc_node mm/slub.c:3251 [inline]
 slab_alloc mm/slub.c:3259 [inline]
 __kmalloc+0xc3c/0x12d0 mm/slub.c:4437
 kmalloc include/linux/slab.h:595 [inline]
 pneigh_lookup+0x60f/0xd70 net/core/neighbour.c:766
 arp_req_set_public net/ipv4/arp.c:1016 [inline]
 arp_req_set+0x430/0x10a0 net/ipv4/arp.c:1032
 arp_ioctl+0x8d4/0xb60 net/ipv4/arp.c:1232
 inet_ioctl+0x4ef/0x820 net/ipv4/af_inet.c:947
 sock_do_ioctl net/socket.c:1118 [inline]
 sock_ioctl+0xa3f/0x13e0 net/socket.c:1235
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:874 [inline]
 __se_sys_ioctl+0x2df/0x4a0 fs/ioctl.c:860
 __x64_sys_ioctl+0xd8/0x110 fs/ioctl.c:860
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x44/0xae

CPU: 1 PID: 6375 Comm: syz-executor479 Not tainted 5.16.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
=====================================================

Crashes (14):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/12/07 19:53 https://github.com/google/kmsan.git master 8b936c96768e 0230ba3e .config console log report syz C ci-upstream-kmsan-gce KMSAN: uninit-value in pneigh_fill_info
2021/12/10 17:34 https://github.com/google/kmsan.git master 8b936c96768e 49ca1f59 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in pneigh_fill_info
2021/12/10 13:42 https://github.com/google/kmsan.git master 8b936c96768e 4d4ce9bc .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in pneigh_fill_info
2021/12/09 21:23 https://github.com/google/kmsan.git master 8b936c96768e b54aa474 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in pneigh_fill_info
2021/12/09 15:49 https://github.com/google/kmsan.git master 8b936c96768e b54aa474 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in pneigh_fill_info
2021/12/09 07:50 https://github.com/google/kmsan.git master 8b936c96768e a4a2a501 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in pneigh_fill_info
2021/12/07 18:12 https://github.com/google/kmsan.git master 8b936c96768e 0230ba3e .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in pneigh_fill_info
2021/12/06 12:52 https://github.com/google/kmsan.git master cdfb223e7e63 579a8754 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in pneigh_fill_info
2021/12/03 14:28 https://github.com/google/kmsan.git master 093998ececa3 c7c20675 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in pneigh_fill_info
2021/12/11 05:09 https://github.com/google/kmsan.git master 8b936c96768e 49ca1f59 .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in pneigh_fill_info
2021/12/10 03:46 https://github.com/google/kmsan.git master 8b936c96768e 4d4ce9bc .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in pneigh_fill_info
2021/12/06 14:52 https://github.com/google/kmsan.git master cdfb223e7e63 579a8754 .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in pneigh_fill_info
2021/12/03 17:45 https://github.com/google/kmsan.git master 093998ececa3 c7c20675 .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in pneigh_fill_info
2021/12/03 15:55 https://github.com/google/kmsan.git master 093998ececa3 c7c20675 .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in pneigh_fill_info
* Struck through repros no longer work on HEAD.