KMSAN: uninit-value in validate_beacon

KMSAN: uninit-value in validate_beacon_head
Status: upstream: reported C repro on 2020/11/28 15:37
Reported-by: syzbot+72b99dcf4607e8c770f3@syzkaller.appspotmail.com
Fix commit: 9a6847ba nl80211: fix beacon head validation
Patched on: [ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-upstream-bpf-kasan-gce ci-upstream-gce-leak ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu2-arm32 ci-qemu2-riscv64 ci-upstream-bpf-next-kasan-gce ci-upstream-kmsan-gce ci-upstream-kmsan-gce-386]
First crash: 141d, last: 20h01m

Patch testing requests:
Created	Duration	User	Patch	Repo	Result
2021/04/08 13:46	23m	johannes@sipsolutions.net	patch	https://github.com/google/kmsan.git master	OK
2021/04/05 16:48	15m	alaaemadhossney.ae@gmail.com		https://github.com/google/kmsan.git master	report log
2021/03/25 21:50	24m	alaaemadhossney.ae@gmail.com		https://github.com/google/kmsan.git master	report log

Sample crash report:

=====================================================
BUG: KMSAN: uninit-value in validate_beacon_head+0x4f2/0x5d0 net/wireless/nl80211.c:225
CPU: 0 PID: 8214 Comm: syz-executor516 Not tainted 5.11.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x21c/0x280 lib/dump_stack.c:120
 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118
 __msan_warning+0x5f/0xa0 mm/kmsan/kmsan_instr.c:197
 validate_beacon_head+0x4f2/0x5d0 net/wireless/nl80211.c:225
 validate_nla lib/nlattr.c:544 [inline]
 __nla_validate_parse+0x23e3/0x4da0 lib/nlattr.c:588
 __nla_parse+0x141/0x150 lib/nlattr.c:685
 __nlmsg_parse include/net/netlink.h:733 [inline]
 nlmsg_parse_deprecated include/net/netlink.h:772 [inline]
 nl80211_prepare_wdev_dump+0x6fd/0xbb0 net/wireless/nl80211.c:908
 nl80211_dump_station+0x143/0x740 net/wireless/nl80211.c:5888
 netlink_dump+0xb92/0x1650 net/netlink/af_netlink.c:2268
 __netlink_dump_start+0xcfa/0xea0 net/netlink/af_netlink.c:2373
 genl_family_rcv_msg_dumpit net/netlink/genetlink.c:697 [inline]
 genl_family_rcv_msg net/netlink/genetlink.c:780 [inline]
 genl_rcv_msg+0xfed/0x1610 net/netlink/genetlink.c:800
 netlink_rcv_skb+0x6fa/0x810 net/netlink/af_netlink.c:2494
 genl_rcv+0x63/0x80 net/netlink/genetlink.c:811
 netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
 netlink_unicast+0x11d6/0x14a0 net/netlink/af_netlink.c:1330
 netlink_sendmsg+0x1740/0x1840 net/netlink/af_netlink.c:1919
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg net/socket.c:672 [inline]
 ____sys_sendmsg+0xcfc/0x12f0 net/socket.c:2345
 ___sys_sendmsg net/socket.c:2399 [inline]
 __sys_sendmsg+0x714/0x830 net/socket.c:2432
 __do_sys_sendmsg net/socket.c:2441 [inline]
 __se_sys_sendmsg+0x97/0xb0 net/socket.c:2439
 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2439
 do_syscall_64+0x9f/0x140 arch/x86/entry/common.c:48
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x440679
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd311890b8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00000000004004a0 RCX: 0000000000440679
RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: 00007ffd31189258
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000403980
R13: 431bde82d7b634db R14: 00000000004ae018 R15: 00000000004004a0

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:121 [inline]
 kmsan_internal_poison_shadow+0x5c/0xf0 mm/kmsan/kmsan.c:104
 kmsan_slab_alloc+0x8d/0xe0 mm/kmsan/kmsan_hooks.c:76
 slab_alloc_node mm/slub.c:2907 [inline]
 __kmalloc_node_track_caller+0xa37/0x1430 mm/slub.c:4527
 __kmalloc_reserve net/core/skbuff.c:142 [inline]
 __alloc_skb+0x2f8/0xb30 net/core/skbuff.c:210
 alloc_skb include/linux/skbuff.h:1099 [inline]
 netlink_alloc_large_skb net/netlink/af_netlink.c:1176 [inline]
 netlink_sendmsg+0xdbc/0x1840 net/netlink/af_netlink.c:1894
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg net/socket.c:672 [inline]
 ____sys_sendmsg+0xcfc/0x12f0 net/socket.c:2345
 ___sys_sendmsg net/socket.c:2399 [inline]
 __sys_sendmsg+0x714/0x830 net/socket.c:2432
 __do_sys_sendmsg net/socket.c:2441 [inline]
 __se_sys_sendmsg+0x97/0xb0 net/socket.c:2439
 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2439
 do_syscall_64+0x9f/0x140 arch/x86/entry/common.c:48
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
=====================================================

Crashes (99):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Title
ci-upstream-kmsan-gce	2021/02/20 02:58	https://github.com/google/kmsan.git master	29ad81a1	f689d40a	.config	log	report	syz	C		KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce	2020/12/02 10:04	https://github.com/google/kmsan.git master	73d62e81	c42a35e9	.config	log	report	syz	C
ci-upstream-kmsan-gce	2021/04/14 12:08	https://github.com/google/kmsan.git master	4ebaab5f	3134b37f	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce	2021/04/14 09:53	https://github.com/google/kmsan.git master	4ebaab5f	3134b37f	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce	2021/04/14 07:56	https://github.com/google/kmsan.git master	4ebaab5f	a184b83e	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce	2021/04/12 09:20	https://github.com/google/kmsan.git master	4ebaab5f	bfeda1b1	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce	2021/04/11 01:28	https://github.com/google/kmsan.git master	4ebaab5f	bfeda1b1	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce	2021/04/09 18:14	https://github.com/google/kmsan.git master	29ad81a1	6a81331a	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce	2021/04/09 02:11	https://github.com/google/kmsan.git master	29ad81a1	6a81331a	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce	2021/04/07 20:51	https://github.com/google/kmsan.git master	29ad81a1	6a81331a	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce	2021/03/31 13:32	https://github.com/google/kmsan.git master	29ad81a1	6a81331a	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce	2021/03/29 08:04	https://github.com/google/kmsan.git master	29ad81a1	a8529b82	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce	2021/03/28 14:42	https://github.com/google/kmsan.git master	29ad81a1	a8529b82	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce	2021/03/25 09:09	https://github.com/google/kmsan.git master	29ad81a1	607e3baf	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce	2021/03/20 18:27	https://github.com/google/kmsan.git master	29ad81a1	17810eae	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce	2021/03/19 02:36	https://github.com/google/kmsan.git master	29ad81a1	380dcc3e	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce	2021/03/18 23:00	https://github.com/google/kmsan.git master	29ad81a1	7216542e	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce	2021/03/18 11:49	https://github.com/google/kmsan.git master	29ad81a1	7216542e	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce	2021/03/18 10:23	https://github.com/google/kmsan.git master	29ad81a1	7216542e	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce	2021/03/18 06:52	https://github.com/google/kmsan.git master	29ad81a1	fdb2bb2c	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce	2021/03/18 01:44	https://github.com/google/kmsan.git master	29ad81a1	fdb2bb2c	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce	2021/03/17 03:48	https://github.com/google/kmsan.git master	29ad81a1	fdb2bb2c	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce	2021/03/16 22:30	https://github.com/google/kmsan.git master	29ad81a1	fdb2bb2c	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce	2021/03/15 15:59	https://github.com/google/kmsan.git master	29ad81a1	fdb2bb2c	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce	2021/03/15 12:32	https://github.com/google/kmsan.git master	29ad81a1	cc1cff8f	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce	2021/03/15 02:15	https://github.com/google/kmsan.git master	29ad81a1	cc1cff8f	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce	2021/03/14 11:56	https://github.com/google/kmsan.git master	29ad81a1	4a003785	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce	2021/03/13 04:00	https://github.com/google/kmsan.git master	29ad81a1	429d8a6b	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce	2021/03/11 21:49	https://github.com/google/kmsan.git master	29ad81a1	c2ca1f2a	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce	2021/03/11 11:55	https://github.com/google/kmsan.git master	29ad81a1	c2ca1f2a	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce	2021/03/09 06:29	https://github.com/google/kmsan.git master	29ad81a1	09fbf400	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce	2021/03/04 19:05	https://github.com/google/kmsan.git master	29ad81a1	d7e4e604	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce	2021/02/28 06:25	https://github.com/google/kmsan.git master	29ad81a1	4c37c133	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce	2021/02/26 03:46	https://github.com/google/kmsan.git master	29ad81a1	76f7fc95	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce	2021/02/26 02:58	https://github.com/google/kmsan.git master	29ad81a1	76f7fc95	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce	2021/02/20 00:05	https://github.com/google/kmsan.git master	29ad81a1	f689d40a	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce	2021/02/09 04:33	https://github.com/google/kmsan.git master	73d62e81	2bd9619f	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce	2021/01/29 06:54	https://github.com/google/kmsan.git master	73d62e81	7df34f59	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce-386	2021/04/11 18:36	https://github.com/google/kmsan.git master	4ebaab5f	bfeda1b1	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce-386	2021/04/10 02:50	https://github.com/google/kmsan.git master	4ebaab5f	6a81331a	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce-386	2021/04/09 04:08	https://github.com/google/kmsan.git master	29ad81a1	6a81331a	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce-386	2021/04/08 05:18	https://github.com/google/kmsan.git master	29ad81a1	6a81331a	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce-386	2021/04/07 22:30	https://github.com/google/kmsan.git master	29ad81a1	6a81331a	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce-386	2021/03/30 20:13	https://github.com/google/kmsan.git master	29ad81a1	6a81331a	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce-386	2021/03/27 23:55	https://github.com/google/kmsan.git master	29ad81a1	a8529b82	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce-386	2021/03/12 21:26	https://github.com/google/kmsan.git master	29ad81a1	429d8a6b	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce-386	2021/02/28 13:01	https://github.com/google/kmsan.git master	29ad81a1	4c37c133	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce-386	2021/02/26 03:18	https://github.com/google/kmsan.git master	29ad81a1	76f7fc95	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce-386	2021/02/26 03:06	https://github.com/google/kmsan.git master	29ad81a1	76f7fc95	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce-386	2021/01/29 06:56	https://github.com/google/kmsan.git master	73d62e81	7df34f59	.config	log	report			info	KMSAN: uninit-value in validate_beacon_head
ci-upstream-kmsan-gce	2021/01/17 08:22	https://github.com/google/kmsan.git master	73d62e81	65a7a854	.config	log	report			info
ci-upstream-kmsan-gce-386	2020/11/24 15:08	https://github.com/google/kmsan.git master	73d62e81	1ab681a4	.config	log	report			info