syzbot


KMSAN: uninit-value in find_match

Status: closed as invalid on 2026/03/08 13:42
Subsystems: net
[Documentation on labels]
First crash: 39d, last: 39d
✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision Error
bca61a1f-345f-40fa-89cd-7e34cad7f7f4 repro KMSAN: uninit-value in find_match 2026/03/07 17:56 2026/03/07 17:56 2026/03/07 18:07 31e9c887f7dc24e04b3ca70d0d54fc34141844b0
Similar bugs (11)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in find_match (3) net 2 2 1246d 1289d 0/29 auto-obsoleted due to no activity on 2023/01/16 14:40
upstream general protection fault in find_match (6) net 17 C 102 168d 174d 29/29 fixed on 2025/10/29 21:02
android-6-1 general protection fault in find_match 2 5 149d 302d 0/2 auto-obsoleted due to no activity on 2026/01/09 18:39
upstream general protection fault in find_match (4) net 2 1 930d 926d 0/29 auto-obsoleted due to no activity on 2023/11/20 22:29
upstream general protection fault in find_match (2) net 2 4 1838d 1904d 0/29 auto-closed as invalid on 2021/06/26 04:02
linux-5.15 BUG: unable to handle kernel paging request in find_match 8 5 291d 346d 0/3 auto-obsoleted due to no activity on 2025/08/31 04:44
linux-6.1 BUG: unable to handle kernel paging request in find_match 8 20 167d 285d 0/3 auto-obsoleted due to no activity on 2025/12/18 21:08
android-5-15 general protection fault in find_match 2 7 239d 336d 0/2 auto-obsoleted due to no activity on 2025/10/12 06:00
upstream general protection fault in find_match (5) net 2 2 638d 638d 26/29 fixed on 2024/07/10 10:07
linux-5.15 general protection fault in find_match 2 4 161d 183d 0/3 auto-obsoleted due to no activity on 2026/01/07 16:35
android-5-10 general protection fault in find_match 2 50 160d 339d 0/2 auto-obsoleted due to no activity on 2025/11/21 02:50

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in ip6_ignore_linkdown include/net/addrconf.h:453 [inline]
BUG: KMSAN: uninit-value in find_match+0x264/0x17b0 net/ipv6/route.c:780
 ip6_ignore_linkdown include/net/addrconf.h:453 [inline]
 find_match+0x264/0x17b0 net/ipv6/route.c:780
 __find_rr_leaf+0x271/0xc80 net/ipv6/route.c:868
 find_rr_leaf net/ipv6/route.c:889 [inline]
 rt6_select net/ipv6/route.c:933 [inline]
 fib6_table_lookup+0x42a/0x1100 net/ipv6/route.c:2244
 ip6_pol_route+0x16d/0x2650 net/ipv6/route.c:2280
 ip6_pol_route_input+0x6a/0x90 net/ipv6/route.c:2337
 pol_lookup_func include/net/ip6_fib.h:617 [inline]
 fib6_rule_lookup+0x529/0xa70 net/ipv6/fib6_rules.c:120
 ip6_route_input_lookup net/ipv6/route.c:2349 [inline]
 ip6_route_input+0xba7/0xee0 net/ipv6/route.c:2652
 ip6_rcv_finish_core net/ipv6/ip6_input.c:66 [inline]
 ip6_rcv_finish+0x529/0x990 net/ipv6/ip6_input.c:77
 NF_HOOK include/linux/netfilter.h:318 [inline]
 ipv6_rcv+0xf1/0x3c0 net/ipv6/ip6_input.c:311
 __netif_receive_skb_one_core net/core/dev.c:6152 [inline]
 __netif_receive_skb net/core/dev.c:6265 [inline]
 process_backlog+0x62f/0x1500 net/core/dev.c:6617
 __napi_poll+0xdc/0x8f0 net/core/dev.c:7681
 napi_poll net/core/dev.c:7744 [inline]
 net_rx_action+0xa5b/0x1c70 net/core/dev.c:7896
 handle_softirqs+0x168/0x6f0 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x65/0x170 kernel/softirq.c:723
 irq_exit_rcu+0x12/0x20 kernel/softirq.c:739
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
 sysvec_apic_timer_interrupt+0x84/0x90 arch/x86/kernel/apic/apic.c:1056
 asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:697
 memmove+0x28/0x1b0 arch/x86/lib/memmove_64.S:45
 ext4_xattr_set_entry+0x1935/0x3440 fs/ext4/xattr.c:1783
 ext4_xattr_block_set+0xc74/0x5040 fs/ext4/xattr.c:2030
 ext4_xattr_set_handle+0x297a/0x2b10 fs/ext4/xattr.c:2457
 ext4_xattr_set+0x2ff/0x5a0 fs/ext4/xattr.c:2559
 ext4_xattr_trusted_set+0x51/0x70 fs/ext4/xattr_trusted.c:38
 __vfs_setxattr+0x742/0x840 fs/xattr.c:200
 __vfs_setxattr_noperm+0x224/0xad0 fs/xattr.c:234
 __vfs_setxattr_locked+0x43c/0x480 fs/xattr.c:295
 vfs_setxattr+0x28d/0x650 fs/xattr.c:321
 do_setxattr fs/xattr.c:636 [inline]
 filename_setxattr+0x3a4/0xcc0 fs/xattr.c:665
 path_setxattrat+0x6c8/0x7c0 fs/xattr.c:713
 __do_sys_lsetxattr fs/xattr.c:754 [inline]
 __se_sys_lsetxattr fs/xattr.c:750 [inline]
 __ia32_sys_lsetxattr+0x100/0x1b0 fs/xattr.c:750
 ia32_sys_call+0x3eee/0x4340 arch/x86/include/generated/asm/syscalls_32.h:228
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
 __do_fast_syscall_32+0x14a/0x310 arch/x86/entry/syscall_32.c:307
 do_fast_syscall_32+0x37/0x80 arch/x86/entry/syscall_32.c:332
 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:370
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e

Uninit was created at:
 __alloc_frozen_pages_noprof+0x6df/0xf50 mm/page_alloc.c:5263
 alloc_pages_mpol+0x328/0x860 mm/mempolicy.c:2486
 alloc_frozen_pages_noprof+0xf6/0x200 mm/mempolicy.c:2557
 alloc_slab_page mm/slub.c:3075 [inline]
 allocate_slab+0x1ea/0x1700 mm/slub.c:3248
 new_slab mm/slub.c:3302 [inline]
 ___slab_alloc+0x1048/0x38b0 mm/slub.c:4656
 __slab_alloc+0xa3/0x180 mm/slub.c:4779
 __slab_alloc_node mm/slub.c:4855 [inline]
 slab_alloc_node mm/slub.c:5251 [inline]
 kmem_cache_alloc_noprof+0xa18/0x1730 mm/slub.c:5270
 __kernfs_new_node+0xe4/0xb80 fs/kernfs/dir.c:637
 kernfs_new_node+0x1f0/0x370 fs/kernfs/dir.c:718
 __kernfs_create_file+0xa2/0x520 fs/kernfs/file.c:1057
 sysfs_add_file_mode_ns+0x3a3/0x4d0 fs/sysfs/file.c:313
 sysfs_merge_group+0x21c/0x580 fs/sysfs/group.c:382
 dpm_sysfs_add+0x192/0x430 drivers/base/power/sysfs.c:704
 device_add+0xe4e/0x1c00 drivers/base/core.c:3649
 usb_add_gadget+0x4e3/0xe60 drivers/usb/gadget/udc/core.c:1421
 usb_add_gadget_udc_release drivers/usb/gadget/udc/core.c:1484 [inline]
 usb_add_gadget_udc+0x11f/0x1a0 drivers/usb/gadget/udc/core.c:1531
 dummy_udc_probe+0xbe6/0x10e0 drivers/usb/gadget/udc/dummy_hcd.c:1099
 platform_probe+0x213/0x370 drivers/base/platform.c:1446
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x4d5/0xe40 drivers/base/dd.c:661
 __driver_probe_device+0x25e/0x370 drivers/base/dd.c:803
 driver_probe_device+0x70/0x8f0 drivers/base/dd.c:833
 __device_attach_driver+0x4ee/0x950 drivers/base/dd.c:961
 bus_for_each_drv+0x3e3/0x680 drivers/base/bus.c:500
 __device_attach+0x3c5/0x5f0 drivers/base/dd.c:1033
 device_initial_probe+0x126/0x170 drivers/base/dd.c:1088
 bus_probe_device+0x287/0x530 drivers/base/bus.c:574
 device_add+0x12a9/0x1c00 drivers/base/core.c:3689
 platform_device_add+0x7ee/0xab0 drivers/base/platform.c:757
 dummy_hcd_init+0xb2f/0x11b0 drivers/usb/gadget/udc/dummy_hcd.c:2866
 do_one_initcall+0x22b/0xad0 init/main.c:1378
 do_initcall_level+0x157/0x2e0 init/main.c:1440
 do_initcalls+0x176/0x310 init/main.c:1456
 do_basic_setup+0x1d/0x30 init/main.c:1475
 kernel_init_freeable+0x213/0x430 init/main.c:1688
 kernel_init+0x2f/0x5e0 init/main.c:1578
 ret_from_fork+0x207/0x6f0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

CPU: 1 UID: 0 PID: 12394 Comm: syz.7.2162 Tainted: G             L      syzkaller #0 PREEMPT(voluntary) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
=====================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/30 07:49 upstream 4d310797262f bfa73b7b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in find_match
* Struck through repros no longer work on HEAD.