syzbot


KMSAN: uninit-value in __kmalloc_track_caller

Status: closed as invalid on 2018/09/27 12:03
Subsystems: net
[Documentation on labels]
First crash: 2181d, last: 2058d

Sample crash report:
8021q: adding VLAN 0 to HW filter on device team0
8021q: adding VLAN 0 to HW filter on device team0
8021q: adding VLAN 0 to HW filter on device team0
==================================================================
BUG: KMSAN: uninit-value in slab_alloc_node mm/slub.c:2738 [inline]
BUG: KMSAN: uninit-value in slab_alloc mm/slub.c:2761 [inline]
BUG: KMSAN: uninit-value in __kmalloc_track_caller+0x531/0xc80 mm/slub.c:4365
CPU: 1 PID: 10954 Comm: syz-executor4 Not tainted 4.17.0+ #5
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x185/0x1d0 lib/dump_stack.c:113
 kmsan_report+0x188/0x2a0 mm/kmsan/kmsan.c:1117
 __msan_warning_32+0x70/0xc0 mm/kmsan/kmsan_instr.c:620
 slab_alloc_node mm/slub.c:2738 [inline]
 slab_alloc mm/slub.c:2761 [inline]
 __kmalloc_track_caller+0x531/0xc80 mm/slub.c:4365
 kmemdup+0x95/0x140 mm/util.c:118
 neigh_sysctl_register+0xbe/0xd60 net/core/neighbour.c:3180
 devinet_sysctl_register+0x154/0x3a0 net/ipv4/devinet.c:2346
 inetdev_init+0x546/0xa60 net/ipv4/devinet.c:263
 inetdev_event+0xf14/0x1db0 net/ipv4/devinet.c:1456
 notifier_call_chain kernel/notifier.c:93 [inline]
 __raw_notifier_call_chain kernel/notifier.c:394 [inline]
 raw_notifier_call_chain+0x13e/0x240 kernel/notifier.c:401
 call_netdevice_notifiers_info net/core/dev.c:1734 [inline]
 call_netdevice_notifiers net/core/dev.c:1752 [inline]
 register_netdevice+0x2178/0x2720 net/core/dev.c:7990
 tun_set_iff drivers/net/tun.c:2668 [inline]
 __tun_chr_ioctl+0x512e/0x6950 drivers/net/tun.c:2897
 tun_chr_ioctl+0x9c/0xb0 drivers/net/tun.c:3169
 vfs_ioctl fs/ioctl.c:46 [inline]
 do_vfs_ioctl+0xcbd/0x24b0 fs/ioctl.c:686
 ksys_ioctl fs/ioctl.c:701 [inline]
 __do_sys_ioctl fs/ioctl.c:708 [inline]
 __se_sys_ioctl fs/ioctl.c:706 [inline]
 __x64_sys_ioctl+0x280/0x320 fs/ioctl.c:706
 do_syscall_64+0x15b/0x230 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x4559f9
RSP: 002b:00007f5b06e04c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f5b06e056d4 RCX: 00000000004559f9
RDX: 0000000020000040 RSI: 00000000400454ca RDI: 0000000000000004
RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 00000000004be8b5 R14: 00000000004cd1c0 R15: 0000000000000000

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:279 [inline]
 kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:189
 kmsan_kmalloc+0x94/0x100 mm/kmsan/kmsan.c:315
 kmsan_slab_alloc+0x10/0x20 mm/kmsan/kmsan.c:322
 slab_post_alloc_hook mm/slab.h:446 [inline]
 slab_alloc_node mm/slub.c:2753 [inline]
 __kmalloc_node_track_caller+0xb35/0x11b0 mm/slub.c:4395
 __kmalloc_reserve net/core/skbuff.c:138 [inline]
 __alloc_skb+0x2cb/0x9e0 net/core/skbuff.c:206
 alloc_skb include/linux/skbuff.h:988 [inline]
 alloc_skb_with_frags+0x1e6/0xb80 net/core/skbuff.c:5254
 sock_alloc_send_pskb+0xb56/0x11a0 net/core/sock.c:2088
 sock_alloc_send_skb+0xca/0xe0 net/core/sock.c:2105
 mld_newpack+0x2af/0xd00 net/ipv6/mcast.c:1585
 add_grhead net/ipv6/mcast.c:1689 [inline]
 add_grec+0x1dd4/0x2280 net/ipv6/mcast.c:1820
 mld_send_cr net/ipv6/mcast.c:1946 [inline]
 mld_ifc_timer_expire+0x10af/0x15a0 net/ipv6/mcast.c:2451
 call_timer_fn+0x280/0x5d0 kernel/time/timer.c:1326
 expire_timers kernel/time/timer.c:1363 [inline]
 __run_timers+0xd96/0x11b0 kernel/time/timer.c:1666
 run_timer_softirq+0x43/0x70 kernel/time/timer.c:1692
 __do_softirq+0x592/0x979 kernel/softirq.c:285
==================================================================

Crashes (10):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/06/09 10:25 https://github.com/google/kmsan.git master d6c351f832e3 866118af .config console log report syz ci-upstream-kmsan-gce
2018/09/06 22:18 https://github.com/google/kmsan.git master 43e4752ae5dc e30d3b52 .config console log report ci-upstream-kmsan-gce
2018/08/29 02:19 https://github.com/google/kmsan.git master 2dca2cbde67a b771b17e .config console log report ci-upstream-kmsan-gce
2018/07/20 07:43 https://github.com/google/kmsan.git master cf8cd3cd03e2 49f35839 .config console log report ci-upstream-kmsan-gce
2018/07/15 03:46 https://github.com/google/kmsan.git master 80ecacc456c1 92a49505 .config console log report ci-upstream-kmsan-gce
2018/06/20 23:25 https://github.com/google/kmsan.git master 123906095e30 095ef806 .config console log report ci-upstream-kmsan-gce
2018/06/15 18:34 https://github.com/google/kmsan.git master 88e0e95b30f1 27c5f59f .config console log report ci-upstream-kmsan-gce
2018/06/09 01:41 https://github.com/google/kmsan.git master d6c351f832e3 866118af .config console log report ci-upstream-kmsan-gce
2018/05/30 01:19 https://github.com/google/kmsan.git master 1b9cd4eccac9 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/05/07 00:58 https://github.com/google/kmsan.git master d2d741e5d189 a211da1a .config console log report ci-upstream-kmsan-gce
* Struck through repros no longer work on HEAD.