syzbot

 sign-in | mailing list | source | docs
🐞 Open [979] ≡ Subsystems 🐞 Fixed [5216] 🐞 Invalid [12474] ⬇ Missing Backports [82] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

KMSAN: uninit-value in ip_check_mc_rcu (2)

Status: auto-closed as invalid on 2020/06/09 09:57
Subsystems: net
[Documentation on labels]
First crash: 2028d, last: 1499d
▶ ▼ Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in ip_check_mc_rcu net 9 2048d 2128d 0/26 closed as invalid on 2018/09/21 18:23
upstream KMSAN: uninit-value in ip_check_mc_rcu (3) net 4 1274d 1314d 0/26 auto-closed as invalid on 2021/02/19 08:44

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in ip_check_mc_rcu+0x2a9/0x690 net/ipv4/igmp.c:2717
CPU: 1 PID: 14519 Comm: syz-executor.2 Not tainted 5.6.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c9/0x220 lib/dump_stack.c:118
 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118
 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215
 ip_check_mc_rcu+0x2a9/0x690 net/ipv4/igmp.c:2717
 __mkroute_output net/ipv4/route.c:2392 [inline]
 ip_route_output_key_hash_rcu+0x1cfd/0x38d0 net/ipv4/route.c:2674
 ip_route_output_key_hash net/ipv4/route.c:2500 [inline]
 __ip_route_output_key include/net/route.h:126 [inline]
 ip_route_output_flow+0x1e1/0x3d0 net/ipv4/route.c:2763
 ip_route_output_key include/net/route.h:136 [inline]
 ip_tunnel_xmit+0x130e/0x34f0 net/ipv4/ip_tunnel.c:753
 __gre_xmit net/ipv4/ip_gre.c:448 [inline]
 ipgre_xmit+0xfe7/0x1110 net/ipv4/ip_gre.c:632
 __netdev_start_xmit include/linux/netdevice.h:4524 [inline]
 netdev_start_xmit include/linux/netdevice.h:4538 [inline]
 xmit_one net/core/dev.c:3470 [inline]
 dev_hard_start_xmit+0x531/0xab0 net/core/dev.c:3486
 __dev_queue_xmit+0x37de/0x4220 net/core/dev.c:4063
 dev_queue_xmit+0x4b/0x60 net/core/dev.c:4096
 packet_snd net/packet/af_packet.c:2967 [inline]
 packet_sendmsg+0x8347/0x93b0 net/packet/af_packet.c:2992
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg net/socket.c:672 [inline]
 ____sys_sendmsg+0x12b6/0x1350 net/socket.c:2343
 ___sys_sendmsg net/socket.c:2397 [inline]
 __sys_sendmsg+0x451/0x5f0 net/socket.c:2430
 __do_sys_sendmsg net/socket.c:2439 [inline]
 __se_sys_sendmsg+0x97/0xb0 net/socket.c:2437
 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2437
 do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45c4a9
Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f99e0c74c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f99e0c756d4 RCX: 000000000045c4a9
RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000000008
RBP: 000000000076bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 00000000000009f2 R14: 00000000004cc6f3 R15: 000000000076bf2c

Uninit was stored to memory at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:144 [inline]
 kmsan_internal_chain_origin+0xad/0x130 mm/kmsan/kmsan.c:310
 __msan_chain_origin+0x50/0x90 mm/kmsan/kmsan_instr.c:165
 ip_tunnel_init_flow include/net/ip_tunnels.h:248 [inline]
 ip_tunnel_xmit+0xc0a/0x34f0 net/ipv4/ip_tunnel.c:735
 __gre_xmit net/ipv4/ip_gre.c:448 [inline]
 ipgre_xmit+0xfe7/0x1110 net/ipv4/ip_gre.c:632
 __netdev_start_xmit include/linux/netdevice.h:4524 [inline]
 netdev_start_xmit include/linux/netdevice.h:4538 [inline]
 xmit_one net/core/dev.c:3470 [inline]
 dev_hard_start_xmit+0x531/0xab0 net/core/dev.c:3486
 __dev_queue_xmit+0x37de/0x4220 net/core/dev.c:4063
 dev_queue_xmit+0x4b/0x60 net/core/dev.c:4096
 packet_snd net/packet/af_packet.c:2967 [inline]
 packet_sendmsg+0x8347/0x93b0 net/packet/af_packet.c:2992
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg net/socket.c:672 [inline]
 ____sys_sendmsg+0x12b6/0x1350 net/socket.c:2343
 ___sys_sendmsg net/socket.c:2397 [inline]
 __sys_sendmsg+0x451/0x5f0 net/socket.c:2430
 __do_sys_sendmsg net/socket.c:2439 [inline]
 __se_sys_sendmsg+0x97/0xb0 net/socket.c:2437
 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2437
 do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Uninit was stored to memory at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:144 [inline]
 kmsan_internal_chain_origin+0xad/0x130 mm/kmsan/kmsan.c:310
 kmsan_memcpy_memmove_metadata+0x272/0x2e0 mm/kmsan/kmsan.c:247
 kmsan_memcpy_metadata+0xb/0x10 mm/kmsan/kmsan.c:267
 __msan_memcpy+0x43/0x50 mm/kmsan/kmsan_instr.c:116
 pskb_expand_head+0x38b/0x1b00 net/core/skbuff.c:1638
 __skb_cow include/linux/skbuff.h:3139 [inline]
 skb_cow_head include/linux/skbuff.h:3173 [inline]
 ipgre_xmit+0x6d0/0x1110 net/ipv4/ip_gre.c:611
 __netdev_start_xmit include/linux/netdevice.h:4524 [inline]
 netdev_start_xmit include/linux/netdevice.h:4538 [inline]
 xmit_one net/core/dev.c:3470 [inline]
 dev_hard_start_xmit+0x531/0xab0 net/core/dev.c:3486
 __dev_queue_xmit+0x37de/0x4220 net/core/dev.c:4063
 dev_queue_xmit+0x4b/0x60 net/core/dev.c:4096
 packet_snd net/packet/af_packet.c:2967 [inline]
 packet_sendmsg+0x8347/0x93b0 net/packet/af_packet.c:2992
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg net/socket.c:672 [inline]
 ____sys_sendmsg+0x12b6/0x1350 net/socket.c:2343
 ___sys_sendmsg net/socket.c:2397 [inline]
 __sys_sendmsg+0x451/0x5f0 net/socket.c:2430
 __do_sys_sendmsg net/socket.c:2439 [inline]
 __se_sys_sendmsg+0x97/0xb0 net/socket.c:2437
 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2437
 do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:144 [inline]
 kmsan_internal_poison_shadow+0x66/0xd0 mm/kmsan/kmsan.c:127
 kmsan_slab_alloc+0x8a/0xe0 mm/kmsan/kmsan_hooks.c:82
 slab_alloc_node mm/slub.c:2793 [inline]
 __kmalloc_node_track_caller+0xb40/0x1200 mm/slub.c:4401
 __kmalloc_reserve net/core/skbuff.c:142 [inline]
 __alloc_skb+0x2fd/0xac0 net/core/skbuff.c:210
 alloc_skb include/linux/skbuff.h:1051 [inline]
 alloc_skb_with_frags+0x18c/0xa70 net/core/skbuff.c:5766
 sock_alloc_send_pskb+0xada/0xc60 net/core/sock.c:2242
 packet_alloc_skb net/packet/af_packet.c:2815 [inline]
 packet_snd net/packet/af_packet.c:2910 [inline]
 packet_sendmsg+0x66a0/0x93b0 net/packet/af_packet.c:2992
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg net/socket.c:672 [inline]
 ____sys_sendmsg+0x12b6/0x1350 net/socket.c:2343
 ___sys_sendmsg net/socket.c:2397 [inline]
 __sys_sendmsg+0x451/0x5f0 net/socket.c:2430
 __do_sys_sendmsg net/socket.c:2439 [inline]
 __se_sys_sendmsg+0x97/0xb0 net/socket.c:2437
 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2437
 do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
=====================================================

Crashes (70):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/03/11 09:55 https://github.com/google/kmsan.git master 8bbbc5cf3dca 35f53e45 .config console log report ci-upstream-kmsan-gce
2020/03/09 15:04 https://github.com/google/kmsan.git master 8bbbc5cf3dca 2e9971bb .config console log report ci-upstream-kmsan-gce
2020/02/28 04:12 https://github.com/google/kmsan.git master 8bbbc5cf3dca 59b57593 .config console log report ci-upstream-kmsan-gce
2020/02/25 12:25 https://github.com/google/kmsan.git master 8bbbc5cf3dca 59b57593 .config console log report ci-upstream-kmsan-gce
2020/02/17 20:04 https://github.com/google/kmsan.git master 686a4f77cb0c 2b411596 .config console log report ci-upstream-kmsan-gce
2020/02/15 15:42 https://github.com/google/kmsan.git master 686a4f77cb0c 5d7b90f1 .config console log report ci-upstream-kmsan-gce
2020/02/14 03:31 https://github.com/google/kmsan.git master 686a4f77cb0c c5ed587f .config console log report ci-upstream-kmsan-gce
2020/02/12 19:11 https://github.com/google/kmsan.git master 686a4f77cb0c 84f4fc8a .config console log report ci-upstream-kmsan-gce
2020/01/26 21:22 https://github.com/google/kmsan.git master 686a4f77cb0c dd56146d .config console log report ci-upstream-kmsan-gce
2020/01/26 01:48 https://github.com/google/kmsan.git master 686a4f77cb0c f4e7270e .config console log report ci-upstream-kmsan-gce
2020/01/17 15:52 https://github.com/google/kmsan.git master 686a4f77cb0c 3de7aabb .config console log report ci-upstream-kmsan-gce
2020/01/16 00:38 https://github.com/google/kmsan.git master 686a4f77cb0c f9b69507 .config console log report ci-upstream-kmsan-gce
2020/01/14 17:39 https://github.com/google/kmsan.git master 686a4f77cb0c 32881205 .config console log report ci-upstream-kmsan-gce
2020/01/14 01:10 https://github.com/google/kmsan.git master 686a4f77cb0c 32881205 .config console log report ci-upstream-kmsan-gce
2019/12/27 03:20 https://github.com/google/kmsan.git master 997a8b55bc92 be5c2c81 .config console log report ci-upstream-kmsan-gce
2019/12/18 19:11 https://github.com/google/kmsan.git master 9e5effe4b0cd f2fe0772 .config console log report ci-upstream-kmsan-gce
2019/12/06 04:39 https://github.com/google/kmsan.git master f8f75f037ea5 98b4ef2d .config console log report ci-upstream-kmsan-gce
2019/12/04 17:24 https://github.com/google/kmsan.git master 141b13f7780f b2088328 .config console log report ci-upstream-kmsan-gce
2019/12/03 05:16 https://github.com/google/kmsan.git master 940694c19feb ab342da3 .config console log report ci-upstream-kmsan-gce
2019/11/29 18:04 https://github.com/google/kmsan.git master e2027b2c33b7 d29b9e84 .config console log report ci-upstream-kmsan-gce
2019/11/28 13:07 https://github.com/google/kmsan.git master aef8527c93a9 46869e3e .config console log report ci-upstream-kmsan-gce
2019/11/28 03:15 https://github.com/google/kmsan.git master c543ab669ab8 0d63f89c .config console log report ci-upstream-kmsan-gce
2019/11/27 19:47 https://github.com/google/kmsan.git master c543ab669ab8 0d63f89c .config console log report ci-upstream-kmsan-gce
2019/11/26 02:25 https://github.com/google/kmsan.git master 4a1d41e39c62 f746151a .config console log report ci-upstream-kmsan-gce
2019/11/23 09:18 https://github.com/google/kmsan.git master 4a1d41e39c62 598ca6c8 .config console log report ci-upstream-kmsan-gce
2019/11/22 17:09 https://github.com/google/kmsan.git master b7a871998d3e 598ca6c8 .config console log report ci-upstream-kmsan-gce
2019/11/08 07:36 https://github.com/google/kmsan.git master e741088f2efa f39aff9e .config console log report ci-upstream-kmsan-gce
2019/11/06 04:53 https://github.com/google/kmsan.git master c235b34ba03a bc2c6e45 .config console log report ci-upstream-kmsan-gce
2019/11/03 18:55 https://github.com/google/kmsan.git master 6f88939b3fa3 c9610487 .config console log report ci-upstream-kmsan-gce
2019/11/03 18:01 https://github.com/google/kmsan.git master 6f88939b3fa3 c9610487 .config console log report ci-upstream-kmsan-gce
2019/10/31 13:31 https://github.com/google/kmsan.git master 6f88939b3fa3 a41ca8fa .config console log report ci-upstream-kmsan-gce
2019/10/28 20:57 https://github.com/google/kmsan.git master 96c6c3194b1b 439d7b14 .config console log report ci-upstream-kmsan-gce
2019/10/25 17:15 https://github.com/google/kmsan.git master d86c15562d02 c2e837da .config console log report ci-upstream-kmsan-gce
2019/10/22 23:16 https://github.com/google/kmsan.git master 3c8ca70889aa 5681358a .config console log report ci-upstream-kmsan-gce
2019/10/22 18:09 https://github.com/google/kmsan.git master 3c8ca70889aa 5681358a .config console log report ci-upstream-kmsan-gce
2019/10/22 06:53 https://github.com/google/kmsan.git master 3c8ca70889aa c59a7cd8 .config console log report ci-upstream-kmsan-gce
2019/10/21 12:13 https://github.com/google/kmsan.git master 3c8ca70889aa 8c88c9c1 .config console log report ci-upstream-kmsan-gce
2019/10/02 00:24 https://github.com/google/kmsan.git master f5f9d3ce4686 b7a87a83 .config console log report ci-upstream-kmsan-gce
2019/09/28 19:41 https://github.com/google/kmsan.git master 124037e07586 eb6b9855 .config console log report ci-upstream-kmsan-gce
2019/09/23 09:37 https://github.com/google/kmsan.git master cebbfdbcf2b7 d96e88f3 .config console log report ci-upstream-kmsan-gce
2019/07/19 22:22 https://github.com/google/kmsan.git master beaab8a31e0d 1656845f .config console log report ci-upstream-kmsan-gce
2019/06/29 17:11 https://github.com/google/kmsan.git master 41550654dedf 7509bf36 .config console log report ci-upstream-kmsan-gce
2019/06/29 01:59 https://github.com/google/kmsan.git master 41550654dedf 7509bf36 .config console log report ci-upstream-kmsan-gce
2019/04/18 15:37 https://github.com/google/kmsan.git master 199a02db1f61 b0e8efcb .config console log report ci-upstream-kmsan-gce
2019/04/18 15:29 https://github.com/google/kmsan.git master 199a02db1f61 b0e8efcb .config console log report ci-upstream-kmsan-gce
2019/04/17 22:15 https://github.com/google/kmsan.git master 199a02db1f61 b0e8efcb .config console log report ci-upstream-kmsan-gce
2019/04/13 00:53 https://github.com/google/kmsan.git master 199a02db1f61 c402d8f1 .config console log report ci-upstream-kmsan-gce
2019/04/11 20:10 https://github.com/google/kmsan.git master 199a02db1f61 13030ef8 .config console log report ci-upstream-kmsan-gce
2019/04/11 19:50 https://github.com/google/kmsan.git master 199a02db1f61 13030ef8 .config console log report ci-upstream-kmsan-gce
2019/04/10 02:22 https://github.com/google/kmsan.git master c1f8455db49c 65b612b7 .config console log report ci-upstream-kmsan-gce
2019/04/06 19:30 https://github.com/google/kmsan.git master 46200eb9666d c34fde03 .config console log report ci-upstream-kmsan-gce
2019/03/30 05:00 https://github.com/google/kmsan.git master 088c01ea0855 c35ee0ea .config console log report ci-upstream-kmsan-gce
2019/03/15 20:29 https://github.com/google/kmsan.git master 63fd07faa48c bab43553 .config console log report ci-upstream-kmsan-gce
2019/03/14 07:34 https://github.com/google/kmsan.git master c530a275757b d09a902e .config console log report ci-upstream-kmsan-gce
2019/02/18 07:04 https://github.com/google/kmsan.git master fa1981bee40f 59f36113 .config console log report ci-upstream-kmsan-gce
2019/02/10 06:35 https://github.com/google/kmsan.git master fa1981bee40f b4f792e4 .config console log report ci-upstream-kmsan-gce
2019/02/08 22:26 https://github.com/google/kmsan.git master fa1981bee40f fa6c7b70 .config console log report ci-upstream-kmsan-gce
2019/02/08 18:49 https://github.com/google/kmsan.git master fa1981bee40f fa6c7b70 .config console log report ci-upstream-kmsan-gce
2019/01/29 03:12 https://github.com/google/kmsan.git master fa1981bee40f aa432daf .config console log report ci-upstream-kmsan-gce
2019/01/28 11:29 https://github.com/google/kmsan.git master 02f2d5aea531 629c2a27 .config console log report ci-upstream-kmsan-gce
2019/01/24 11:20 https://github.com/google/kmsan.git master 02f2d5aea531 ce1ccf97 .config console log report ci-upstream-kmsan-gce
2019/01/06 03:07 https://github.com/google/kmsan.git master 11587f6ee534 53be0a37 .config console log report ci-upstream-kmsan-gce
2018/12/31 17:50 https://github.com/google/kmsan.git master 8ba10281f9e5 2b42fdc8 .config console log report ci-upstream-kmsan-gce
2018/11/25 11:12 https://github.com/google/kmsan.git master fffec98ae2a6 3d3ec907 .config console log report ci-upstream-kmsan-gce
2018/11/21 22:37 https://github.com/google/kmsan.git master 3ededcaa1606 9db828b5 .config console log report ci-upstream-kmsan-gce
2018/11/21 22:20 https://github.com/google/kmsan.git master 3ededcaa1606 9db828b5 .config console log report ci-upstream-kmsan-gce
2018/10/01 22:23 https://github.com/google/kmsan.git master 2b752aff835d e06f7713 .config console log report ci-upstream-kmsan-gce
2018/10/01 09:56 https://github.com/google/kmsan.git master 2b752aff835d 48a50c6b .config console log report ci-upstream-kmsan-gce
2018/09/29 18:11 https://github.com/google/kmsan.git master 2b752aff835d 41e4b329 .config console log report ci-upstream-kmsan-gce
* Struck through repros no longer work on HEAD.