syzbot


KMSAN: uninit-value in bpf_prog_run_generic_xdp

Status: upstream: reported C repro on 2022/11/18 11:39
Subsystems: can
[Documentation on labels]
Reported-by: syzbot+0e6ddb1ef80986bdfe64@syzkaller.appspotmail.com
First crash: 879d, last: 14h06m
Discussions (9)
Title Replies (including bot) Last reply
[syzbot] KMSAN: uninit-value in bpf_prog_run_generic_xdp 0 (2) 2024/03/16 16:19
[syzbot] Monthly bpf report (Mar 2024) 0 (1) 2024/03/11 10:18
[syzbot] Monthly bpf report (Feb 2024) 0 (1) 2024/02/08 21:48
[syzbot] Monthly can report (Jan 2024) 0 (1) 2024/01/16 07:55
Re: [syzbot] KMSAN: uninit-value in bpf_prog_run_generic_xdp 1 (1) 2023/12/21 11:22
[syzbot] Monthly can report (Dec 2023) 0 (1) 2023/12/02 14:45
[syzbot] Monthly bpf report (Nov 2023) 0 (1) 2023/11/07 04:52
[syzbot] Monthly can report (Nov 2023) 0 (1) 2023/11/01 10:13
[syzbot] Monthly batman report (Oct 2023) 0 (1) 2023/10/09 09:23
Similar bugs (18)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in skb_release_data (3) net C 10 653d 1332d 0/26 auto-obsoleted due to no activity on 2022/11/17 07:20
upstream KMSAN: uninit-value in hsr_register_frame_in net C 197 287d 1908d 0/26 auto-obsoleted due to no activity on 2024/02/18 18:09
upstream KMSAN: kernel-infoleak in copyout (2) net C 6723 331d 1499d 22/26 fixed on 2023/06/08 14:41
upstream KMSAN: uninit-value in ipv6_find_tlv net C 271 372d 1725d 22/26 fixed on 2023/06/08 14:41
upstream KMSAN: uninit-value in ax25cmp (2) hams C 51 590d 851d 0/26 closed as invalid on 2022/11/18 11:50
upstream KMSAN: uninit-value in virtqueue_add (3) virt 13 547d 839d 0/26 auto-obsoleted due to no activity on 2023/02/12 03:53
upstream KMSAN: kernel-infoleak in _copy_to_iter (7) net C 138977 434d 786d 22/26 fixed on 2023/02/24 13:50
upstream KMSAN: kernel-infoleak in __skb_datagram_iter net 68 220d 325d 23/26 fixed on 2023/09/28 17:51
upstream KMSAN: uninit-value in can_send can C 630 529d 547d 22/26 fixed on 2023/02/24 13:50
upstream KMSAN: uninit-value in IP6_ECN_decapsulate net C 981 136d 2052d 25/26 fixed on 2023/12/21 03:45
upstream KMSAN: uninit-value in inet_frag_find (2) net 2 843d 851d 0/26 auto-closed as invalid on 2022/04/11 17:13
upstream KMSAN: kernel-infoleak in _copy_to_iter (6) net C 748 787d 876d 20/26 fixed on 2022/03/08 16:11
upstream KMSAN: uninit-value in eth_type_trans (2) net C 4530 21m 1563d 0/26 upstream: reported C repro on 2020/01/22 16:47
upstream KMSAN: uninit-value in hsr_fill_frame_info (2) net C 65 286d 569d 0/26 auto-obsoleted due to no activity on 2023/10/30 13:38
upstream KMSAN: uninit-value in erspan_build_header net 40 479d 569d 0/26 auto-obsoleted due to no activity on 2023/05/10 10:26
upstream KMSAN: uninit-value in ip_tunnel_xmit (3) net C 1516 575d 1262d 0/26 closed as invalid on 2022/10/12 18:48
upstream KMSAN: uninit-value in br_dev_xmit bridge C 537 474d 1530d 0/26 auto-obsoleted due to no activity on 2023/05/15 13:28
upstream KMSAN: uninit-value in batadv_get_vid batman C 1947 426d 1530d 0/26 auto-obsoleted due to no activity on 2023/07/23 05:56

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in bpf_prog_run_generic_xdp+0x13a0/0x1ee0 net/core/dev.c:4876
 bpf_prog_run_generic_xdp+0x13a0/0x1ee0 net/core/dev.c:4876
 netif_receive_generic_xdp net/core/dev.c:4958 [inline]
 do_xdp_generic+0xb68/0x1440 net/core/dev.c:5017
 __netif_receive_skb_core+0x2533/0x6190 net/core/dev.c:5358
 __netif_receive_skb_one_core net/core/dev.c:5536 [inline]
 __netif_receive_skb+0xca/0xa00 net/core/dev.c:5652
 process_backlog+0x480/0x8b0 net/core/dev.c:5981
 __napi_poll+0xe7/0x980 net/core/dev.c:6632
 napi_poll net/core/dev.c:6701 [inline]
 net_rx_action+0x89d/0x1820 net/core/dev.c:6813
 __do_softirq+0x1c0/0x7d7 kernel/softirq.c:554
 invoke_softirq kernel/softirq.c:428 [inline]
 __irq_exit_rcu kernel/softirq.c:633 [inline]
 irq_exit_rcu+0x6a/0x130 kernel/softirq.c:645
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
 sysvec_apic_timer_interrupt+0x83/0x90 arch/x86/kernel/apic/apic.c:1043
 asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:702
 __preempt_count_dec_and_test arch/x86/include/asm/preempt.h:94 [inline]
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
 _raw_spin_unlock_irqrestore+0x33/0x60 kernel/locking/spinlock.c:194
 unlock_hrtimer_base kernel/time/hrtimer.c:1021 [inline]
 hrtimer_start_range_ns+0x112c/0x11a0 kernel/time/hrtimer.c:1308
 hrtimer_start include/linux/hrtimer.h:275 [inline]
 j1939_tp_schedule_txtimer+0xc2/0x100 net/can/j1939/transport.c:702
 j1939_sk_send_loop net/can/j1939/socket.c:1164 [inline]
 j1939_sk_sendmsg+0x1a0e/0x2730 net/can/j1939/socket.c:1277
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg+0x30f/0x380 net/socket.c:745
 ____sys_sendmsg+0x877/0xb60 net/socket.c:2584
 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638
 __sys_sendmsg net/socket.c:2667 [inline]
 __do_sys_sendmsg net/socket.c:2676 [inline]
 __se_sys_sendmsg net/socket.c:2674 [inline]
 __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2674
 do_syscall_64+0xd5/0x1f0
 entry_SYSCALL_64_after_hwframe+0x6d/0x75

Uninit was stored to memory at:
 pskb_expand_head+0x30f/0x19d0 net/core/skbuff.c:2253
 netif_skb_check_for_xdp net/core/dev.c:4921 [inline]
 netif_receive_generic_xdp net/core/dev.c:4952 [inline]
 do_xdp_generic+0x931/0x1440 net/core/dev.c:5017
 __netif_receive_skb_core+0x2533/0x6190 net/core/dev.c:5358
 __netif_receive_skb_one_core net/core/dev.c:5536 [inline]
 __netif_receive_skb+0xca/0xa00 net/core/dev.c:5652
 process_backlog+0x480/0x8b0 net/core/dev.c:5981
 __napi_poll+0xe7/0x980 net/core/dev.c:6632
 napi_poll net/core/dev.c:6701 [inline]
 net_rx_action+0x89d/0x1820 net/core/dev.c:6813
 __do_softirq+0x1c0/0x7d7 kernel/softirq.c:554

Uninit was created at:
 slab_post_alloc_hook mm/slub.c:3804 [inline]
 slab_alloc_node mm/slub.c:3845 [inline]
 kmem_cache_alloc_node+0x613/0xc50 mm/slub.c:3888
 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577
 __alloc_skb+0x35b/0x7a0 net/core/skbuff.c:668
 alloc_skb include/linux/skbuff.h:1318 [inline]
 alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6504
 sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2795
 sock_alloc_send_skb include/net/sock.h:1835 [inline]
 j1939_sk_alloc_skb net/can/j1939/socket.c:878 [inline]
 j1939_sk_send_loop net/can/j1939/socket.c:1142 [inline]
 j1939_sk_sendmsg+0xc0a/0x2730 net/can/j1939/socket.c:1277
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg+0x30f/0x380 net/socket.c:745
 ____sys_sendmsg+0x877/0xb60 net/socket.c:2584
 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638
 __sys_sendmsg net/socket.c:2667 [inline]
 __do_sys_sendmsg net/socket.c:2676 [inline]
 __se_sys_sendmsg net/socket.c:2674 [inline]
 __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2674
 do_syscall_64+0xd5/0x1f0
 entry_SYSCALL_64_after_hwframe+0x6d/0x75

CPU: 0 PID: 5044 Comm: syz-executor640 Not tainted 6.8.0-syzkaller-11136-g66a27abac311 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
=====================================================

Crashes (373):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/03/16 16:19 upstream 66a27abac311 d615901c .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/03 15:51 upstream f03359bca01b 375d4445 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/03 07:19 upstream 49a73b1652c5 ddfc15a1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/03 01:49 upstream 49a73b1652c5 ddfc15a1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/02 11:18 upstream 0106679839f7 3ba885bc .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/01 18:53 upstream 18daea77cca6 3ba885bc .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/01 06:52 upstream 50dffbf77180 9e0e6af1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/01 06:38 upstream 50dffbf77180 9e0e6af1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/01 04:38 upstream 50dffbf77180 9e0e6af1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/05/01 02:51 upstream 50dffbf77180 9e0e6af1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/04/30 19:21 upstream 50dffbf77180 9e0e6af1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/04/30 00:53 upstream b947cc5bf6d7 27e33c58 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/04/29 15:10 upstream e67572cd2204 27e33c58 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/04/29 12:08 upstream e67572cd2204 27e33c58 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/04/28 22:17 upstream 2c8159388952 07b455f9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/04/28 05:56 upstream 5d12ed4bea43 07b455f9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/04/27 10:59 upstream 5eb4573ea63d 07b455f9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/04/27 08:13 upstream 5eb4573ea63d 07b455f9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/04/26 22:28 upstream c942a0cd3603 059e9963 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/04/26 17:13 upstream c942a0cd3603 059e9963 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/04/26 06:56 upstream e33c4963bf53 8bdc0f22 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/04/25 08:10 upstream e88c4cfcb7b8 8bdc0f22 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/04/25 03:27 upstream e88c4cfcb7b8 8bdc0f22 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/04/25 01:50 upstream e88c4cfcb7b8 8bdc0f22 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/04/24 11:52 upstream 9d1ddab261f3 21339d7b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/04/24 00:43 upstream 71b1543c83d6 21339d7b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/04/23 22:36 upstream 71b1543c83d6 21339d7b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/04/23 12:22 upstream 4d2008430ce8 21339d7b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/04/22 16:55 upstream ed30a4a51bb1 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/04/22 01:23 upstream 3b68086599f8 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/04/21 23:35 upstream 3b68086599f8 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/04/21 11:25 upstream 977b1ef51866 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/04/29 04:34 upstream e67572cd2204 07b455f9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/04/28 11:52 upstream 2c8159388952 07b455f9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/04/28 03:03 upstream 5d12ed4bea43 07b455f9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/04/27 14:01 upstream 5eb4573ea63d 07b455f9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/04/27 09:20 upstream 5eb4573ea63d 07b455f9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/04/26 18:23 upstream c942a0cd3603 059e9963 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/04/26 16:09 upstream c942a0cd3603 059e9963 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/04/26 03:13 upstream e33c4963bf53 8bdc0f22 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/04/24 02:09 upstream 71b1543c83d6 21339d7b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/04/23 21:14 upstream 71b1543c83d6 21339d7b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/04/23 03:04 upstream 4d2008430ce8 21339d7b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/04/21 20:34 upstream 48cf398f15fc af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2024/04/21 19:27 upstream 977b1ef51866 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in bpf_prog_run_generic_xdp
2023/12/16 05:36 upstream 3bd7d7488169 3222d10c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386 KMSAN: uninit-value in bpf_prog_run_generic_xdp
2022/11/15 12:56 https://github.com/google/kmsan.git master cb231e2f67ec 97de9cfc .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386 KMSAN: uninit-value in bpf_prog_run_generic_xdp
2022/01/03 16:49 https://github.com/google/kmsan.git master 81c325bbf94e 4a3f34f2 .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in bpf_prog_run_generic_xdp
2021/12/06 12:45 https://github.com/google/kmsan.git master cdfb223e7e63 579a8754 .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in bpf_prog_run_generic_xdp
* Struck through repros no longer work on HEAD.