syzbot

 sign-in | mailing list | source | docs
🐞 Open [1037] ≡ Subsystems 🐞 Fixed [5279] 🐞 Invalid [12607] ⬇ Missing Backports [87] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

KMSAN: uninit-value in expire_timers (2)

Status: auto-closed as invalid on 2021/06/26 09:57
Subsystems: kernel
[Documentation on labels]
First crash: 1176d, last: 1139d
▶ ▼ Similar bugs (8)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in expire_timers (3) ext4 1 1041d 1041d 0/26 auto-closed as invalid on 2021/10/02 12:28
upstream KMSAN: uninit-value in expire_timers (4) kernel 1 912d 912d 0/26 auto-closed as invalid on 2022/02/08 07:20
upstream KMSAN: uninit-value in expire_timers kernel 15 1368d 1372d 0/26 auto-closed as invalid on 2020/10/11 00:10
upstream KASAN: slab-use-after-free Write in expire_timers mm acpi batman 7 371d 373d 0/26 auto-obsoleted due to no activity on 2023/08/23 09:02
upstream KASAN: use-after-free Write in expire_timers arm 1 537d 536d 0/26 auto-obsoleted due to no activity on 2023/03/20 12:09
android-54 BUG: unable to handle kernel paging request in expire_timers 3 1127d 1220d 0/2 auto-closed as invalid on 2021/08/07 04:23
android-54 BUG: unable to handle kernel paging request in expire_timers (2) 6 474d 725d 0/2 auto-obsoleted due to no activity on 2023/05/22 09:21
android-54 general protection fault in expire_timers 1 1135d 1135d 0/2 auto-closed as invalid on 2021/07/30 19:44

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in expire_timers+0x52c/0x6c0 kernel/time/timer.c:1455
CPU: 0 PID: 4680 Comm: systemd-udevd Not tainted 5.11.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x21c/0x280 lib/dump_stack.c:120
 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118
 __msan_warning+0x5f/0xa0 mm/kmsan/kmsan_instr.c:197
 expire_timers+0x52c/0x6c0 kernel/time/timer.c:1455
 __run_timers+0x624/0x9e0 kernel/time/timer.c:1731
 run_timer_softirq+0x2d/0x50 kernel/time/timer.c:1744
 __do_softirq+0x1b9/0x715 kernel/softirq.c:343
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x6e/0x90 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:226 [inline]
 __irq_exit_rcu+0x22f/0x280 kernel/softirq.c:420
 irq_exit_rcu+0xe/0x10 kernel/softirq.c:432
 sysvec_apic_timer_interrupt+0x106/0x130 arch/x86/kernel/apic/apic.c:1100
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:647
RIP: 0010:kmsan_slab_free+0x9b/0xc0 mm/kmsan/kmsan_hooks.c:104
Code: 00 00 00 e8 47 e9 ff ff e8 72 e6 ff ff 8b b0 b0 0f 00 00 ff ce 89 b0 b0 0f 00 00 75 1a e8 3d 3a 0d ff 4c 89 7d e0 ff 75 e0 9d <48> 83 c4 10 5b 41 5e 41 5f 5d c3 0f 0b 48 c7 c7 2b b7 5a 90 31 c0
RSP: 0018:ffff8881179f7aa8 EFLAGS: 00000246
RAX: ffff888113350a78 RBX: ffff888100534700 RCX: 000000000000001f
RDX: 000000000000001e RSI: 0000000000000000 RDI: ffff8881178eeca8
RBP: ffff8881179f7ad0 R08: ffffea000000000f R09: ffff88813fffa000
R10: 00000000a5b60ed7 R11: ffffffff8fa00715 R12: 0000000000000000
R13: 0000000000000000 R14: ffff8881178eeca8 R15: 0000000000000246
 slab_free_freelist_hook mm/slub.c:1580 [inline]
 slab_free mm/slub.c:3159 [inline]
 kmem_cache_free+0x303/0xec0 mm/slub.c:3175
 seq_release+0xaa/0xf0 fs/seq_file.c:353
 kernfs_fop_release+0x326/0x3f0 fs/kernfs/file.c:761
 __fput+0x6bd/0xf00 fs/file_table.c:280
 ____fput+0x37/0x40 fs/file_table.c:313
 task_work_run+0x140/0x280 kernel/task_work.c:140
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:174 [inline]
 exit_to_user_mode_prepare+0x486/0x560 kernel/entry/common.c:201
 __syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline]
 syscall_exit_to_user_mode+0x35/0x60 kernel/entry/common.c:294
 do_syscall_64+0xc5/0x140 arch/x86/entry/common.c:58
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f7cd3118a4b
Code: 48 8b 34 24 eb c5 66 0f 1f 84 00 00 00 00 00 48 c7 c0 ff ff ff ff eb c8 0f 1f 80 00 00 00 00 48 63 7f 70 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 f3 c3 0f 1f 00 48 8b 15 19 74 32 00 f7 d8
RSP: 002b:00007ffdf6399ec8 EFLAGS: 00000206 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 000055d5d5479e50 RCX: 00007f7cd3118a4b
RDX: 00007f7cd343c900 RSI: 0000000000000001 RDI: 000000000000000e
RBP: 00007f7cd343d440 R08: 00007f7cd43108c0 R09: 000055d5d5479e50
R10: 00007f7cd43108c0 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000001000 R15: 00007ffdf639a0a0

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:121 [inline]
 kmsan_internal_poison_shadow+0x5c/0xf0 mm/kmsan/kmsan.c:104
 kmsan_slab_alloc+0x8d/0xe0 mm/kmsan/kmsan_hooks.c:76
 slab_alloc_node mm/slub.c:2907 [inline]
 slab_alloc mm/slub.c:2916 [inline]
 __kmalloc_track_caller+0x94c/0x11c0 mm/slub.c:4496
 kmemdup+0x95/0x140 mm/util.c:128
 __addrconf_sysctl_register+0xe1/0x7e0 net/ipv6/addrconf.c:6913
 addrconf_sysctl_register+0x323/0x3e0 net/ipv6/addrconf.c:6978
 ipv6_add_dev+0x1312/0x1b60 net/ipv6/addrconf.c:443
 addrconf_notify+0xd44/0x6540 net/ipv6/addrconf.c:3489
 notifier_call_chain kernel/notifier.c:83 [inline]
 raw_notifier_call_chain+0x123/0x290 kernel/notifier.c:410
 call_netdevice_notifiers_info net/core/dev.c:2040 [inline]
 call_netdevice_notifiers_extack net/core/dev.c:2052 [inline]
 call_netdevice_notifiers net/core/dev.c:2066 [inline]
 register_netdevice+0x30fb/0x3a20 net/core/dev.c:10089
 hsr_dev_finalize+0x9cc/0xec0 net/hsr/hsr_device.c:565
 hsr_newlink+0xc09/0xcc0 net/hsr/hsr_netlink.c:102
 __rtnl_newlink net/core/rtnetlink.c:3443 [inline]
 rtnl_newlink+0x2e8c/0x3d40 net/core/rtnetlink.c:3491
 rtnetlink_rcv_msg+0x1442/0x18a0 net/core/rtnetlink.c:5553
 netlink_rcv_skb+0x6fa/0x810 net/netlink/af_netlink.c:2494
 rtnetlink_rcv+0x50/0x60 net/core/rtnetlink.c:5571
 netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
 netlink_unicast+0x11d6/0x14a0 net/netlink/af_netlink.c:1330
 netlink_sendmsg+0x1740/0x1840 net/netlink/af_netlink.c:1919
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg net/socket.c:672 [inline]
 __sys_sendto+0x9ea/0xc60 net/socket.c:1975
 __do_compat_sys_socketcall net/compat.c:476 [inline]
 __se_compat_sys_socketcall+0xa2c/0x16b0 net/compat.c:424
 __ia32_compat_sys_socketcall+0x3e/0x60 net/compat.c:424
 do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline]
 __do_fast_syscall_32+0x102/0x160 arch/x86/entry/common.c:141
 do_fast_syscall_32+0x6a/0xc0 arch/x86/entry/common.c:166
 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:209
 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c
=====================================================
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 0 P4D 0 
Oops: 0010 [#1] SMP
CPU: 0 PID: 4680 Comm: systemd-udevd Tainted: G    B             5.11.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:0x0
Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
RSP: 0018:ffff88813fc05cf8 EFLAGS: 00010206

RAX: ffffffff819cb048 RBX: 00000000047f0004 RCX: ffff888113350000
RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffff88807ead4d58
RBP: ffff88813fc05d70 R08: ffffffff816485dc R09: ffffffff818e0168
R10: 0000000000000009 R11: ffff888113350000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000100 R15: ffff88813fc27f40
FS:  00007f7cd43108c0(0000) GS:ffff88813fc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 0000000117a4b000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 call_timer_fn+0x7d/0x450 kernel/time/timer.c:1417
 expire_timers+0x328/0x6c0 kernel/time/timer.c:1462
 __run_timers+0x624/0x9e0 kernel/time/timer.c:1731
 run_timer_softirq+0x2d/0x50 kernel/time/timer.c:1744
 __do_softirq+0x1b9/0x715 kernel/softirq.c:343
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x6e/0x90 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:226 [inline]
 __irq_exit_rcu+0x22f/0x280 kernel/softirq.c:420
 irq_exit_rcu+0xe/0x10 kernel/softirq.c:432
 sysvec_apic_timer_interrupt+0x106/0x130 arch/x86/kernel/apic/apic.c:1100
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:647
RIP: 0010:kmsan_slab_free+0x9b/0xc0 mm/kmsan/kmsan_hooks.c:104
Code: 00 00 00 e8 47 e9 ff ff e8 72 e6 ff ff 8b b0 b0 0f 00 00 ff ce 89 b0 b0 0f 00 00 75 1a e8 3d 3a 0d ff 4c 89 7d e0 ff 75 e0 9d <48> 83 c4 10 5b 41 5e 41 5f 5d c3 0f 0b 48 c7 c7 2b b7 5a 90 31 c0
RSP: 0018:ffff8881179f7aa8 EFLAGS: 00000246
RAX: ffff888113350a78 RBX: ffff888100534700 RCX: 000000000000001f
RDX: 000000000000001e RSI: 0000000000000000 RDI: ffff8881178eeca8
RBP: ffff8881179f7ad0 R08: ffffea000000000f R09: ffff88813fffa000
R10: 00000000a5b60ed7 R11: ffffffff8fa00715 R12: 0000000000000000
R13: 0000000000000000 R14: ffff8881178eeca8 R15: 0000000000000246
 slab_free_freelist_hook mm/slub.c:1580 [inline]
 slab_free mm/slub.c:3159 [inline]
 kmem_cache_free+0x303/0xec0 mm/slub.c:3175
 seq_release+0xaa/0xf0 fs/seq_file.c:353
 kernfs_fop_release+0x326/0x3f0 fs/kernfs/file.c:761
 __fput+0x6bd/0xf00 fs/file_table.c:280
 ____fput+0x37/0x40 fs/file_table.c:313
 task_work_run+0x140/0x280 kernel/task_work.c:140
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:174 [inline]
 exit_to_user_mode_prepare+0x486/0x560 kernel/entry/common.c:201
 __syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline]
 syscall_exit_to_user_mode+0x35/0x60 kernel/entry/common.c:294
 do_syscall_64+0xc5/0x140 arch/x86/entry/common.c:58
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f7cd3118a4b
Code: 48 8b 34 24 eb c5 66 0f 1f 84 00 00 00 00 00 48 c7 c0 ff ff ff ff eb c8 0f 1f 80 00 00 00 00 48 63 7f 70 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 f3 c3 0f 1f 00 48 8b 15 19 74 32 00 f7 d8
RSP: 002b:00007ffdf6399ec8 EFLAGS: 00000206 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 000055d5d5479e50 RCX: 00007f7cd3118a4b
RDX: 00007f7cd343c900 RSI: 0000000000000001 RDI: 000000000000000e
RBP: 00007f7cd343d440 R08: 00007f7cd43108c0 R09: 000055d5d5479e50
R10: 00007f7cd43108c0 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000001000 R15: 00007ffdf639a0a0
Modules linked in:
CR2: 0000000000000000
---[ end trace 767c5e2746ca8c7e ]---
RIP: 0010:0x0
Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
RSP: 0018:ffff88813fc05cf8 EFLAGS: 00010206
RAX: ffffffff819cb048 RBX: 00000000047f0004 RCX: ffff888113350000
RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffff88807ead4d58
RBP: ffff88813fc05d70 R08: ffffffff816485dc R09: ffffffff818e0168
R10: 0000000000000009 R11: ffff888113350000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000100 R15: ffff88813fc27f40
FS:  00007f7cd43108c0(0000) GS:ffff88813fc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 0000000117a4b000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/03/28 09:48 https://github.com/google/kmsan.git master 29ad81a1074a a8529b82 .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in expire_timers
2021/02/19 16:59 https://github.com/google/kmsan.git master 29ad81a1074a f689d40a .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in expire_timers
* Struck through repros no longer work on HEAD.