KMSAN: uninit-value in validate_beacon

KMSAN: uninit-value in validate_beacon_head
Status: upstream: reported C repro on 2020/11/28 15:37
Reported-by: syzbot+72b99dcf4607e8c770f3@syzkaller.appspotmail.com
First crash: 61d, last: 1d21h

Sample crash report:

=====================================================
BUG: KMSAN: uninit-value in validate_beacon_head+0x51e/0x5c0 net/wireless/nl80211.c:225
CPU: 0 PID: 8275 Comm: syz-executor237 Not tainted 5.10.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x21c/0x280 lib/dump_stack.c:118
 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118
 __msan_warning+0x5f/0xa0 mm/kmsan/kmsan_instr.c:197
 validate_beacon_head+0x51e/0x5c0 net/wireless/nl80211.c:225
 validate_nla lib/nlattr.c:544 [inline]
 __nla_validate_parse+0x241a/0x4e00 lib/nlattr.c:588
 __nla_parse+0x141/0x150 lib/nlattr.c:685
 __nlmsg_parse include/net/netlink.h:733 [inline]
 nlmsg_parse_deprecated include/net/netlink.h:772 [inline]
 nl80211_prepare_wdev_dump+0x6fd/0xbb0 net/wireless/nl80211.c:891
 nl80211_dump_station+0x143/0x740 net/wireless/nl80211.c:5810
 netlink_dump+0xb92/0x1670 net/netlink/af_netlink.c:2268
 __netlink_dump_start+0xcf1/0xea0 net/netlink/af_netlink.c:2373
 genl_family_rcv_msg_dumpit net/netlink/genetlink.c:697 [inline]
 genl_family_rcv_msg net/netlink/genetlink.c:780 [inline]
 genl_rcv_msg+0xff0/0x1610 net/netlink/genetlink.c:800
 netlink_rcv_skb+0x70a/0x820 net/netlink/af_netlink.c:2494
 genl_rcv+0x63/0x80 net/netlink/genetlink.c:811
 netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
 netlink_unicast+0x11da/0x14b0 net/netlink/af_netlink.c:1330
 netlink_sendmsg+0x173c/0x1840 net/netlink/af_netlink.c:1919
 sock_sendmsg_nosec net/socket.c:651 [inline]
 sock_sendmsg net/socket.c:671 [inline]
 ____sys_sendmsg+0xc7a/0x1240 net/socket.c:2353
 ___sys_sendmsg net/socket.c:2407 [inline]
 __sys_sendmsg+0x6d5/0x830 net/socket.c:2440
 __do_sys_sendmsg net/socket.c:2449 [inline]
 __se_sys_sendmsg+0x97/0xb0 net/socket.c:2447
 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2447
 do_syscall_64+0x9f/0x140 arch/x86/entry/common.c:48
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x4418a9
Code: e8 fc a9 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 06 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffe906479e8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004418a9
RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000003
RBP: 00000000006cc018 R08: 0000000000000000 R09: 00000000004002c8
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000402430
R13: 00000000004024c0 R14: 0000000000000000 R15: 0000000000000000

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:121 [inline]
 kmsan_internal_poison_shadow+0x5c/0xf0 mm/kmsan/kmsan.c:104
 kmsan_slab_alloc+0x8d/0xe0 mm/kmsan/kmsan_hooks.c:76
 slab_alloc_node mm/slub.c:2906 [inline]
 __kmalloc_node_track_caller+0xc61/0x15f0 mm/slub.c:4512
 __kmalloc_reserve net/core/skbuff.c:142 [inline]
 __alloc_skb+0x309/0xae0 net/core/skbuff.c:210
 alloc_skb include/linux/skbuff.h:1094 [inline]
 netlink_alloc_large_skb net/netlink/af_netlink.c:1176 [inline]
 netlink_sendmsg+0xdb8/0x1840 net/netlink/af_netlink.c:1894
 sock_sendmsg_nosec net/socket.c:651 [inline]
 sock_sendmsg net/socket.c:671 [inline]
 ____sys_sendmsg+0xc7a/0x1240 net/socket.c:2353
 ___sys_sendmsg net/socket.c:2407 [inline]
 __sys_sendmsg+0x6d5/0x830 net/socket.c:2440
 __do_sys_sendmsg net/socket.c:2449 [inline]
 __se_sys_sendmsg+0x97/0xb0 net/socket.c:2447
 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2447
 do_syscall_64+0x9f/0x140 arch/x86/entry/common.c:48
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
=====================================================

Crashes (32):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Maintainers
ci-upstream-kmsan-gce	2020/12/02 10:04	https://github.com/google/kmsan.git master	73d62e81	c42a35e9	.config	log	report	syz	C		davem@davemloft.net, johannes@sipsolutions.net, kuba@kernel.org, linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org
ci-upstream-kmsan-gce	2021/01/23 10:34	https://github.com/google/kmsan.git master	73d62e81	52e37319	.config	log	report			info	davem@davemloft.net, johannes@sipsolutions.net, kuba@kernel.org, linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org
ci-upstream-kmsan-gce	2021/01/17 08:22	https://github.com/google/kmsan.git master	73d62e81	65a7a854	.config	log	report			info	davem@davemloft.net, johannes@sipsolutions.net, kuba@kernel.org, linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org
ci-upstream-kmsan-gce	2021/01/12 15:58	https://github.com/google/kmsan.git master	73d62e81	2c1f2513	.config	log	report			info	davem@davemloft.net, johannes@sipsolutions.net, kuba@kernel.org, linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org
ci-upstream-kmsan-gce	2021/01/04 14:44	https://github.com/google/kmsan.git master	73d62e81	79264ae3	.config	log	report			info	davem@davemloft.net, johannes@sipsolutions.net, kuba@kernel.org, linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org
ci-upstream-kmsan-gce	2021/01/04 06:04	https://github.com/google/kmsan.git master	73d62e81	79264ae3	.config	log	report			info	davem@davemloft.net, johannes@sipsolutions.net, kuba@kernel.org, linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org
ci-upstream-kmsan-gce	2021/01/02 12:46	https://github.com/google/kmsan.git master	73d62e81	79264ae3	.config	log	report			info	davem@davemloft.net, johannes@sipsolutions.net, kuba@kernel.org, linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org
ci-upstream-kmsan-gce	2020/12/30 12:23	https://github.com/google/kmsan.git master	73d62e81	0fa352f2	.config	log	report			info	davem@davemloft.net, johannes@sipsolutions.net, kuba@kernel.org, linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org
ci-upstream-kmsan-gce	2020/12/26 15:28	https://github.com/google/kmsan.git master	73d62e81	821e0b09	.config	log	report			info	davem@davemloft.net, johannes@sipsolutions.net, kuba@kernel.org, linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org
ci-upstream-kmsan-gce	2020/12/18 12:58	https://github.com/google/kmsan.git master	73d62e81	04201c06	.config	log	report			info	davem@davemloft.net, johannes@sipsolutions.net, kuba@kernel.org, linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org
ci-upstream-kmsan-gce	2020/12/17 14:32	https://github.com/google/kmsan.git master	73d62e81	04201c06	.config	log	report			info	davem@davemloft.net, johannes@sipsolutions.net, kuba@kernel.org, linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org
ci-upstream-kmsan-gce	2020/12/17 07:52	https://github.com/google/kmsan.git master	73d62e81	04201c06	.config	log	report			info	davem@davemloft.net, johannes@sipsolutions.net, kuba@kernel.org, linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org
ci-upstream-kmsan-gce	2020/12/10 18:55	https://github.com/google/kmsan.git master	73d62e81	f900b48c	.config	log	report			info	davem@davemloft.net, johannes@sipsolutions.net, kuba@kernel.org, linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org
ci-upstream-kmsan-gce	2020/12/10 08:43	https://github.com/google/kmsan.git master	73d62e81	c090b4da	.config	log	report			info	davem@davemloft.net, johannes@sipsolutions.net, kuba@kernel.org, linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org
ci-upstream-kmsan-gce	2020/12/10 06:16	https://github.com/google/kmsan.git master	73d62e81	c090b4da	.config	log	report			info	davem@davemloft.net, johannes@sipsolutions.net, kuba@kernel.org, linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org
ci-upstream-kmsan-gce	2020/12/03 07:12	https://github.com/google/kmsan.git master	73d62e81	8c9190ef	.config	log	report			info	davem@davemloft.net, johannes@sipsolutions.net, kuba@kernel.org, linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org
ci-upstream-kmsan-gce	2020/12/02 06:19	https://github.com/google/kmsan.git master	73d62e81	c42a35e9	.config	log	report			info	davem@davemloft.net, johannes@sipsolutions.net, kuba@kernel.org, linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org
ci-upstream-kmsan-gce-386	2021/01/17 08:21	https://github.com/google/kmsan.git master	73d62e81	65a7a854	.config	log	report			info	davem@davemloft.net, johannes@sipsolutions.net, kuba@kernel.org, linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org
ci-upstream-kmsan-gce-386	2021/01/12 16:16	https://github.com/google/kmsan.git master	73d62e81	2c1f2513	.config	log	report			info	davem@davemloft.net, johannes@sipsolutions.net, kuba@kernel.org, linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org
ci-upstream-kmsan-gce-386	2021/01/12 08:17	https://github.com/google/kmsan.git master	73d62e81	2c1f2513	.config	log	report			info	davem@davemloft.net, johannes@sipsolutions.net, kuba@kernel.org, linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org
ci-upstream-kmsan-gce-386	2021/01/04 06:09	https://github.com/google/kmsan.git master	73d62e81	79264ae3	.config	log	report			info	davem@davemloft.net, johannes@sipsolutions.net, kuba@kernel.org, linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org
ci-upstream-kmsan-gce-386	2021/01/02 12:44	https://github.com/google/kmsan.git master	73d62e81	79264ae3	.config	log	report			info	davem@davemloft.net, johannes@sipsolutions.net, kuba@kernel.org, linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org
ci-upstream-kmsan-gce-386	2020/12/30 12:41	https://github.com/google/kmsan.git master	73d62e81	0fa352f2	.config	log	report			info	davem@davemloft.net, johannes@sipsolutions.net, kuba@kernel.org, linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org
ci-upstream-kmsan-gce-386	2020/12/26 15:31	https://github.com/google/kmsan.git master	73d62e81	821e0b09	.config	log	report			info	davem@davemloft.net, johannes@sipsolutions.net, kuba@kernel.org, linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org
ci-upstream-kmsan-gce-386	2020/12/18 10:51	https://github.com/google/kmsan.git master	73d62e81	04201c06	.config	log	report			info	davem@davemloft.net, johannes@sipsolutions.net, kuba@kernel.org, linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org
ci-upstream-kmsan-gce-386	2020/12/17 14:29	https://github.com/google/kmsan.git master	73d62e81	04201c06	.config	log	report			info	davem@davemloft.net, johannes@sipsolutions.net, kuba@kernel.org, linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org
ci-upstream-kmsan-gce-386	2020/12/17 07:51	https://github.com/google/kmsan.git master	73d62e81	04201c06	.config	log	report			info	davem@davemloft.net, johannes@sipsolutions.net, kuba@kernel.org, linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org
ci-upstream-kmsan-gce-386	2020/12/10 08:42	https://github.com/google/kmsan.git master	73d62e81	c090b4da	.config	log	report			info	davem@davemloft.net, johannes@sipsolutions.net, kuba@kernel.org, linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org
ci-upstream-kmsan-gce-386	2020/12/10 06:13	https://github.com/google/kmsan.git master	73d62e81	c090b4da	.config	log	report			info	davem@davemloft.net, johannes@sipsolutions.net, kuba@kernel.org, linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org
ci-upstream-kmsan-gce-386	2020/12/03 07:05	https://github.com/google/kmsan.git master	73d62e81	8c9190ef	.config	log	report			info	davem@davemloft.net, johannes@sipsolutions.net, kuba@kernel.org, linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org
ci-upstream-kmsan-gce-386	2020/11/29 05:55	https://github.com/google/kmsan.git master	73d62e81	a0092f9d	.config	log	report			info	davem@davemloft.net, johannes@sipsolutions.net, kuba@kernel.org, linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org
ci-upstream-kmsan-gce-386	2020/11/24 15:08	https://github.com/google/kmsan.git master	73d62e81	1ab681a4	.config	log	report			info	davem@davemloft.net, johannes@sipsolutions.net, kuba@kernel.org, linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org