syzbot

 sign-in | mailing list | source | docs
🐞 Open [961] 🐞 Fixed [3806] 🐞 Invalid [8177] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes

KMSAN: uninit-value in skb_trim
Status: upstream: reported C repro on 2020/08/24 13:58
Reported-by: syzbot+e4534e8c1c382508312c@syzkaller.appspotmail.com
First crash: 644d, last: 2d13h
similar bugs (1):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in ath9k_htc_rx_msg C 13674 1d02h 655d 0/22 upstream: reported C repro on 2020/08/09 16:27
Patch testing requests:
Created Duration User Patch Repo Result
2021/05/02 19:10 38m phil@philpotter.co.uk patch https://github.com/google/kmsan.git master OK
2021/05/01 22:12 41m phil@philpotter.co.uk https://github.com/google/kmsan.git master report log
2021/04/19 22:25 28m phil@philpotter.co.uk https://github.com/google/kmsan.git master report log

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in skb_trim+0x1fa/0x280 net/core/skbuff.c:1927
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.11.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x21c/0x280 lib/dump_stack.c:120
 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118
 __msan_warning+0x5f/0xa0 mm/kmsan/kmsan_instr.c:197
 skb_trim+0x1fa/0x280 net/core/skbuff.c:1927
 ath9k_htc_rx_msg+0x631/0x1f30 drivers/net/wireless/ath/ath9k/htc_hst.c:455
 ath9k_hif_usb_rx_stream drivers/net/wireless/ath/ath9k/hif_usb.c:647 [inline]
 ath9k_hif_usb_rx_cb+0x184e/0x1d20 drivers/net/wireless/ath/ath9k/hif_usb.c:680
 __usb_hcd_giveback_urb+0x6ff/0x930 drivers/usb/core/hcd.c:1656
 usb_hcd_giveback_urb+0x1cb/0x730 drivers/usb/core/hcd.c:1726
 dummy_timer+0xda7/0x74f0 drivers/usb/gadget/udc/dummy_hcd.c:1971
 call_timer_fn+0x7d/0x450 kernel/time/timer.c:1417
 expire_timers+0x328/0x6c0 kernel/time/timer.c:1462
 __run_timers+0x624/0x9e0 kernel/time/timer.c:1731
 run_timer_softirq+0x2d/0x50 kernel/time/timer.c:1744
 __do_softirq+0x1b9/0x715 kernel/softirq.c:343
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x6e/0x90 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:226 [inline]
 __irq_exit_rcu+0x22f/0x280 kernel/softirq.c:420
 irq_exit_rcu+0xe/0x10 kernel/softirq.c:432
 sysvec_apic_timer_interrupt+0x106/0x130 arch/x86/kernel/apic/apic.c:1100
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:647
RIP: 0010:native_irq_disable arch/x86/include/asm/irqflags.h:49 [inline]
RIP: 0010:arch_local_irq_disable arch/x86/include/asm/irqflags.h:89 [inline]
RIP: 0010:acpi_safe_halt drivers/acpi/processor_idle.c:111 [inline]
RIP: 0010:acpi_idle_do_entry drivers/acpi/processor_idle.c:516 [inline]
RIP: 0010:acpi_idle_enter+0x61d/0x760 drivers/acpi/processor_idle.c:647
Code: f7 d3 44 21 e3 48 85 db 0f 84 ec 00 00 00 4d 85 e4 0f 85 f4 00 00 00 e9 0c 00 00 00 e8 1c b5 3a fb 0f 00 2d 5f e7 5d 09 fb f4 <fa> e9 e0 00 00 00 84 c0 8b 7d b8 0f 45 7d 98 e8 8f 3b bc fb e9 e5
RSP: 0018:ffffffff91403b70 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000023eaec040
RDX: ffffffff91431040 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffffff91403c08 R08: ffffffff86809bde R09: ffff88813fffa000
R10: 0000000000000002 R11: ffffffff91431040 R12: 0000000000000000
R13: ffff888102fa0064 R14: 0000000000000000 R15: ffffffff91431ab8
 cpuidle_enter_state+0x99e/0x1750 drivers/cpuidle/cpuidle.c:237
 cpuidle_enter+0xe3/0x170 drivers/cpuidle/cpuidle.c:351
 call_cpuidle kernel/sched/idle.c:158 [inline]
 cpuidle_idle_call kernel/sched/idle.c:239 [inline]
 do_idle+0x5df/0x790 kernel/sched/idle.c:299
 cpu_startup_entry+0x45/0x50 kernel/sched/idle.c:396
 rest_init+0x1c8/0x1f0 init/main.c:721
 arch_call_rest_init+0x13/0x15
 start_kernel+0xa17/0xbd8 init/main.c:1064
 x86_64_start_reservations+0x2a/0x2c arch/x86/kernel/head64.c:525
 x86_64_start_kernel+0x86/0x89 arch/x86/kernel/head64.c:506
 secondary_startup_64_no_verify+0xb0/0xbb

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:121 [inline]
 kmsan_internal_poison_shadow+0x5c/0xf0 mm/kmsan/kmsan.c:104
 kmsan_slab_alloc+0x8d/0xe0 mm/kmsan/kmsan_hooks.c:76
 slab_alloc_node mm/slub.c:2907 [inline]
 __kmalloc_node_track_caller+0xa37/0x1430 mm/slub.c:4527
 __kmalloc_reserve net/core/skbuff.c:142 [inline]
 __alloc_skb+0x2f8/0xb30 net/core/skbuff.c:210
 __netdev_alloc_skb+0x450/0x7f0 net/core/skbuff.c:446
 __dev_alloc_skb include/linux/skbuff.h:2839 [inline]
 ath9k_hif_usb_rx_stream drivers/net/wireless/ath/ath9k/hif_usb.c:629 [inline]
 ath9k_hif_usb_rx_cb+0xe58/0x1d20 drivers/net/wireless/ath/ath9k/hif_usb.c:680
 __usb_hcd_giveback_urb+0x6ff/0x930 drivers/usb/core/hcd.c:1656
 usb_hcd_giveback_urb+0x1cb/0x730 drivers/usb/core/hcd.c:1726
 dummy_timer+0xda7/0x74f0 drivers/usb/gadget/udc/dummy_hcd.c:1971
 call_timer_fn+0x7d/0x450 kernel/time/timer.c:1417
 expire_timers+0x328/0x6c0 kernel/time/timer.c:1462
 __run_timers+0x624/0x9e0 kernel/time/timer.c:1731
 run_timer_softirq+0x2d/0x50 kernel/time/timer.c:1744
 __do_softirq+0x1b9/0x715 kernel/softirq.c:343
=====================================================
=====================================================
BUG: KMSAN: uninit-value in skb_trim+0x1fa/0x280 net/core/skbuff.c:1927
CPU: 0 PID: 0 Comm: swapper/0 Tainted: G    B             5.11.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x21c/0x280 lib/dump_stack.c:120
 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118
 __msan_warning+0x5f/0xa0 mm/kmsan/kmsan_instr.c:197
 skb_trim+0x1fa/0x280 net/core/skbuff.c:1927
 ath9k_htc_rx_msg+0x631/0x1f30 drivers/net/wireless/ath/ath9k/htc_hst.c:455
 ath9k_hif_usb_rx_stream drivers/net/wireless/ath/ath9k/hif_usb.c:647 [inline]
 ath9k_hif_usb_rx_cb+0x184e/0x1d20 drivers/net/wireless/ath/ath9k/hif_usb.c:680
 __usb_hcd_giveback_urb+0x6ff/0x930 drivers/usb/core/hcd.c:1656
 usb_hcd_giveback_urb+0x1cb/0x730 drivers/usb/core/hcd.c:1726
 dummy_timer+0xda7/0x74f0 drivers/usb/gadget/udc/dummy_hcd.c:1971
 call_timer_fn+0x7d/0x450 kernel/time/timer.c:1417
 expire_timers+0x328/0x6c0 kernel/time/timer.c:1462
 __run_timers+0x624/0x9e0 kernel/time/timer.c:1731
 run_timer_softirq+0x2d/0x50 kernel/time/timer.c:1744
 __do_softirq+0x1b9/0x715 kernel/softirq.c:343
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x6e/0x90 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:226 [inline]
 __irq_exit_rcu+0x22f/0x280 kernel/softirq.c:420
 irq_exit_rcu+0xe/0x10 kernel/softirq.c:432
 sysvec_apic_timer_interrupt+0x106/0x130 arch/x86/kernel/apic/apic.c:1100
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:647
RIP: 0010:native_irq_disable arch/x86/include/asm/irqflags.h:49 [inline]
RIP: 0010:arch_local_irq_disable arch/x86/include/asm/irqflags.h:89 [inline]
RIP: 0010:acpi_safe_halt drivers/acpi/processor_idle.c:111 [inline]
RIP: 0010:acpi_idle_do_entry drivers/acpi/processor_idle.c:516 [inline]
RIP: 0010:acpi_idle_enter+0x61d/0x760 drivers/acpi/processor_idle.c:647
Code: f7 d3 44 21 e3 48 85 db 0f 84 ec 00 00 00 4d 85 e4 0f 85 f4 00 00 00 e9 0c 00 00 00 e8 1c b5 3a fb 0f 00 2d 5f e7 5d 09 fb f4 <fa> e9 e0 00 00 00 84 c0 8b 7d b8 0f 45 7d 98 e8 8f 3b bc fb e9 e5
RSP: 0018:ffffffff91403b70 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000023eaec040
RDX: ffffffff91431040 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffffff91403c08 R08: ffffffff86809bde R09: ffff88813fffa000
R10: 0000000000000002 R11: ffffffff91431040 R12: 0000000000000000
R13: ffff888102fa0064 R14: 0000000000000000 R15: ffffffff91431ab8
 cpuidle_enter_state+0x99e/0x1750 drivers/cpuidle/cpuidle.c:237
 cpuidle_enter+0xe3/0x170 drivers/cpuidle/cpuidle.c:351
 call_cpuidle kernel/sched/idle.c:158 [inline]
 cpuidle_idle_call kernel/sched/idle.c:239 [inline]
 do_idle+0x5df/0x790 kernel/sched/idle.c:299
 cpu_startup_entry+0x45/0x50 kernel/sched/idle.c:396
 rest_init+0x1c8/0x1f0 init/main.c:721
 arch_call_rest_init+0x13/0x15
 start_kernel+0xa17/0xbd8 init/main.c:1064
 x86_64_start_reservations+0x2a/0x2c arch/x86/kernel/head64.c:525
 x86_64_start_kernel+0x86/0x89 arch/x86/kernel/head64.c:506
 secondary_startup_64_no_verify+0xb0/0xbb

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:121 [inline]
 kmsan_internal_poison_shadow+0x5c/0xf0 mm/kmsan/kmsan.c:104
 kmsan_slab_alloc+0x8d/0xe0 mm/kmsan/kmsan_hooks.c:76
 slab_alloc_node mm/slub.c:2907 [inline]
 __kmalloc_node_track_caller+0xa37/0x1430 mm/slub.c:4527
 __kmalloc_reserve net/core/skbuff.c:142 [inline]
 __alloc_skb+0x2f8/0xb30 net/core/skbuff.c:210
 __netdev_alloc_skb+0x450/0x7f0 net/core/skbuff.c:446
 __dev_alloc_skb include/linux/skbuff.h:2839 [inline]
 ath9k_hif_usb_rx_stream drivers/net/wireless/ath/ath9k/hif_usb.c:629 [inline]
 ath9k_hif_usb_rx_cb+0xe58/0x1d20 drivers/net/wireless/ath/ath9k/hif_usb.c:680
 __usb_hcd_giveback_urb+0x6ff/0x930 drivers/usb/core/hcd.c:1656
 usb_hcd_giveback_urb+0x1cb/0x730 drivers/usb/core/hcd.c:1726
 dummy_timer+0xda7/0x74f0 drivers/usb/gadget/udc/dummy_hcd.c:1971
 call_timer_fn+0x7d/0x450 kernel/time/timer.c:1417
 expire_timers+0x328/0x6c0 kernel/time/timer.c:1462
 __run_timers+0x624/0x9e0 kernel/time/timer.c:1731
 run_timer_softirq+0x2d/0x50 kernel/time/timer.c:1744
 __do_softirq+0x1b9/0x715 kernel/softirq.c:343
=====================================================

Crashes (507):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kmsan-gce 2021/03/21 09:13 https://github.com/google/kmsan.git master 29ad81a1074a 17810eae .config log report syz C KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce 2022/05/24 02:40 https://github.com/google/kmsan.git master c5c93da9af13 e7f9308d .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce 2022/05/23 17:51 https://github.com/google/kmsan.git master c5c93da9af13 4c7657cb .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce 2022/05/22 18:20 https://github.com/google/kmsan.git master c5c93da9af13 7268fa62 .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce 2022/05/19 03:29 https://github.com/google/kmsan.git master c5c93da9af13 50c53f39 .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce 2022/05/17 06:29 https://github.com/google/kmsan.git master d6e2c8c7eb40 744a39e2 .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce 2022/05/13 09:23 https://github.com/google/kmsan.git master d6e2c8c7eb40 9ad6612a .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce 2022/05/13 06:32 https://github.com/google/kmsan.git master d6e2c8c7eb40 9ad6612a .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce 2022/05/12 06:15 https://github.com/google/kmsan.git master d6e2c8c7eb40 beb0b407 .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce 2022/05/11 12:55 https://github.com/google/kmsan.git master d6e2c8c7eb40 8d7b3b67 .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce 2022/05/11 07:21 https://github.com/google/kmsan.git master d6e2c8c7eb40 8d7b3b67 .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce 2022/05/10 15:14 https://github.com/google/kmsan.git master d6e2c8c7eb40 8b277b8e .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce 2022/05/10 06:30 https://github.com/google/kmsan.git master d6e2c8c7eb40 8b277b8e .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce 2022/04/28 13:40 https://github.com/google/kmsan.git master d6e2c8c7eb40 8a1f1f07 .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce 2022/04/28 09:02 https://github.com/google/kmsan.git master d6e2c8c7eb40 8a1f1f07 .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce 2022/04/26 16:47 https://github.com/google/kmsan.git master e8cbf4e6e3e8 1fa34c1b .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce 2022/04/25 22:12 https://github.com/google/kmsan.git master b834db009dc5 152baedd .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce 2022/04/25 17:05 https://github.com/google/kmsan.git master b834db009dc5 c889aef9 .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce 2022/04/25 05:01 https://github.com/google/kmsan.git master b834db009dc5 131df97d .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce 2022/04/24 09:03 https://github.com/google/kmsan.git master b834db009dc5 131df97d .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce 2022/04/24 05:10 https://github.com/google/kmsan.git master b834db009dc5 131df97d .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce 2022/04/22 14:21 https://github.com/google/kmsan.git master 33d9269ef6e0 2738b391 .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce 2022/04/22 11:33 https://github.com/google/kmsan.git master 33d9269ef6e0 2738b391 .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce 2022/04/22 11:22 https://github.com/google/kmsan.git master 33d9269ef6e0 2738b391 .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce 2022/04/21 13:10 https://github.com/google/kmsan.git master 33d9269ef6e0 d4befee1 .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce 2022/04/21 08:51 https://github.com/google/kmsan.git master 33d9269ef6e0 d4befee1 .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce 2022/04/20 16:06 https://github.com/google/kmsan.git master 33d9269ef6e0 160a3f31 .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce 2022/04/20 01:10 https://github.com/google/kmsan.git master 33d9269ef6e0 7d7bc738 .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce 2022/04/18 12:55 https://github.com/google/kmsan.git master 33d9269ef6e0 8bcc32a6 .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce 2022/04/17 06:35 https://github.com/google/kmsan.git master 33d9269ef6e0 8bcc32a6 .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce 2022/04/16 09:47 https://github.com/google/kmsan.git master 33d9269ef6e0 8bcc32a6 .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce 2022/04/15 09:48 https://github.com/google/kmsan.git master 33d9269ef6e0 b17b2923 .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce 2022/04/13 22:30 https://github.com/google/kmsan.git master 33d9269ef6e0 b17b2923 .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce 2022/04/13 09:45 https://github.com/google/kmsan.git master 33d9269ef6e0 faabdb86 .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce 2022/04/13 02:16 https://github.com/google/kmsan.git master 33d9269ef6e0 dacb3f1c .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce-386 2022/05/24 09:44 https://github.com/google/kmsan.git master c5c93da9af13 e7f9308d .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce-386 2022/05/23 17:49 https://github.com/google/kmsan.git master c5c93da9af13 4c7657cb .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce-386 2022/05/19 21:37 https://github.com/google/kmsan.git master c5c93da9af13 50c53f39 .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce-386 2022/05/19 04:56 https://github.com/google/kmsan.git master c5c93da9af13 50c53f39 .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce-386 2022/05/13 17:37 https://github.com/google/kmsan.git master d6e2c8c7eb40 107f6434 .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce-386 2022/05/10 20:35 https://github.com/google/kmsan.git master d6e2c8c7eb40 8b277b8e .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce-386 2022/04/27 09:34 https://github.com/google/kmsan.git master d6e2c8c7eb40 1fa34c1b .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce-386 2022/04/26 03:03 https://github.com/google/kmsan.git master b834db009dc5 152baedd .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce-386 2022/04/22 21:59 https://github.com/google/kmsan.git master b834db009dc5 131df97d .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce-386 2022/04/17 08:52 https://github.com/google/kmsan.git master 33d9269ef6e0 8bcc32a6 .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce-386 2022/04/14 00:57 https://github.com/google/kmsan.git master 33d9269ef6e0 b17b2923 .config log report info KMSAN: uninit-value in skb_trim
ci-upstream-kmsan-gce 2021/01/10 09:25 https://github.com/google/kmsan.git master 73d62e81b476 2c1f2513 .config log report info
ci-upstream-kmsan-gce 2020/08/23 17:11 https://github.com/google/kmsan.git master ce8056d1f79e cef5ae68 .config log report
ci-upstream-kmsan-gce 2020/08/20 13:38 https://github.com/google/kmsan.git master ce8056d1f79e ed282a3a .config log report