syzbot


KMSAN: uninit-value in hci_inquiry_cache_update

Status: closed as invalid on 2021/12/14 11:42
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 1323d, last: 1323d

Sample crash report:
==================================================================
BUG: KMSAN: uninit-value in memcmp+0x117/0x180 lib/string.c:865
CPU: 0 PID: 10745 Comm: kworker/u5:2 Not tainted 5.1.0-rc4+ #1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: hci0 hci_rx_work
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x173/0x1d0 lib/dump_stack.c:113
 kmsan_report+0x131/0x2a0 mm/kmsan/kmsan.c:619
 __msan_warning+0x7a/0xf0 mm/kmsan/kmsan_instr.c:310
 memcmp+0x117/0x180 lib/string.c:865
 bacmp include/net/bluetooth/bluetooth.h:232 [inline]
 hci_inquiry_cache_lookup net/bluetooth/hci_core.c:1093 [inline]
 hci_inquiry_cache_update+0x430/0x19c0 net/bluetooth/hci_core.c:1168
 hci_inquiry_result_with_rssi_evt net/bluetooth/hci_event.c:3995 [inline]
 hci_event_packet+0x924e/0x35950 net/bluetooth/hci_event.c:5863
 hci_rx_work+0x478/0xcc0 net/bluetooth/hci_core.c:4458
 process_one_work+0x1607/0x2010 kernel/workqueue.c:2269
 worker_thread+0x111c/0x2460 kernel/workqueue.c:2415
 kthread+0x4a1/0x4e0 kernel/kthread.c:254
 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:355

Uninit was stored to memory at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:205 [inline]
 kmsan_save_stack mm/kmsan/kmsan.c:220 [inline]
 kmsan_internal_chain_origin+0x134/0x230 mm/kmsan/kmsan.c:426
 kmsan_memcpy_memmove_metadata+0x989/0xd60 mm/kmsan/kmsan.c:304
 kmsan_memcpy_metadata+0xb/0x10 mm/kmsan/kmsan.c:324
 __msan_memcpy+0x58/0x70 mm/kmsan/kmsan_instr.c:139
 bacpy include/net/bluetooth/bluetooth.h:236 [inline]
 hci_inquiry_result_with_rssi_evt net/bluetooth/hci_event.c:3986 [inline]
 hci_event_packet+0x9081/0x35950 net/bluetooth/hci_event.c:5863
 hci_rx_work+0x478/0xcc0 net/bluetooth/hci_core.c:4458
 process_one_work+0x1607/0x2010 kernel/workqueue.c:2269
 worker_thread+0x111c/0x2460 kernel/workqueue.c:2415
 kthread+0x4a1/0x4e0 kernel/kthread.c:254
 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:355

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:205 [inline]
 kmsan_internal_poison_shadow+0x92/0x150 mm/kmsan/kmsan.c:159
 kmsan_kmalloc+0xa9/0x130 mm/kmsan/kmsan_hooks.c:174
 kmsan_slab_alloc+0xe/0x10 mm/kmsan/kmsan_hooks.c:183
 slab_post_alloc_hook mm/slab.h:442 [inline]
 slab_alloc_node mm/slub.c:2771 [inline]
 __kmalloc_node_track_caller+0xead/0x1000 mm/slub.c:4399
 __kmalloc_reserve net/core/skbuff.c:140 [inline]
 __alloc_skb+0x309/0xa20 net/core/skbuff.c:208
 alloc_skb include/linux/skbuff.h:1059 [inline]
 bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
 vhci_get_user drivers/bluetooth/hci_vhci.c:180 [inline]
 vhci_write+0x15b/0x7e0 drivers/bluetooth/hci_vhci.c:299
 call_write_iter include/linux/fs.h:1866 [inline]
 new_sync_write fs/read_write.c:474 [inline]
 __vfs_write+0x99f/0xc30 fs/read_write.c:487
 vfs_write+0x481/0x920 fs/read_write.c:549
 ksys_write+0x20c/0x440 fs/read_write.c:599
 __do_sys_write fs/read_write.c:611 [inline]
 __se_sys_write+0x92/0xb0 fs/read_write.c:608
 __x64_sys_write+0x4a/0x70 fs/read_write.c:608
 do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291
 entry_SYSCALL_64_after_hwframe+0x63/0xe7
==================================================================

Crashes (2):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kmsan-gce 2019/04/15 01:45 https://github.com/google/kmsan.git master 199a02db1f61 505ab413 .config log report syz C
ci-upstream-kmsan-gce 2019/04/15 01:12 https://github.com/google/kmsan.git master 199a02db1f61 505ab413 .config log report syz C
* Struck through repros no longer work on HEAD.