syzbot


KMSAN: uninit-value in fib4_rule_match

Status: closed as invalid on 2018/09/19 13:43
Subsystems: net
[Documentation on labels]
First crash: 2171d, last: 2149d

Sample crash report:
random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
==================================================================
BUG: KMSAN: uninit-value in fib_rule_port_inrange include/net/fib_rules.h:162 [inline]
BUG: KMSAN: uninit-value in fib4_rule_match+0x6eb/0x740 net/ipv4/fib_rules.c:189
CPU: 1 PID: 4523 Comm: syz-executor867 Not tainted 4.17.0-rc5+ #101
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x185/0x1d0 lib/dump_stack.c:113
 kmsan_report+0x149/0x260 mm/kmsan/kmsan.c:1084
 __msan_warning_32+0x6e/0xc0 mm/kmsan/kmsan_instr.c:686
 fib_rule_port_inrange include/net/fib_rules.h:162 [inline]
 fib4_rule_match+0x6eb/0x740 net/ipv4/fib_rules.c:189
 fib_rule_match net/core/fib_rules.c:273 [inline]
 fib_rules_lookup+0xb0c/0xe50 net/core/fib_rules.c:288
 __fib_lookup+0x1bc/0x360 net/ipv4/fib_rules.c:93
 fib_lookup include/net/ip_fib.h:322 [inline]
 __fib_validate_source net/ipv4/fib_frontend.c:353 [inline]
 fib_validate_source+0xc23/0x1d50 net/ipv4/fib_frontend.c:434
 ip_route_input_slow net/ipv4/route.c:1978 [inline]
 ip_route_input_rcu+0x3592/0x6280 net/ipv4/route.c:2152
 ip_route_input_noref+0x10e/0x140 net/ipv4/route.c:2098
 ip_rcv_finish+0x631/0x1d00 net/ipv4/ip_input.c:347
 NF_HOOK include/linux/netfilter.h:288 [inline]
 ip_rcv+0x118f/0x16d0 net/ipv4/ip_input.c:492
 __netif_receive_skb_core+0x47df/0x4a90 net/core/dev.c:4592
 __netif_receive_skb net/core/dev.c:4657 [inline]
 netif_receive_skb_internal+0x49d/0x630 net/core/dev.c:4731
 napi_skb_finish net/core/dev.c:5093 [inline]
 napi_gro_receive+0x6a2/0xb50 net/core/dev.c:5124
 receive_buf+0x4be2/0x6700 drivers/net/virtio_net.c:946
 virtnet_receive drivers/net/virtio_net.c:1202 [inline]
 virtnet_poll+0x98c/0x1520 drivers/net/virtio_net.c:1285
 napi_poll net/core/dev.c:5735 [inline]
 net_rx_action+0x7c1/0x1a70 net/core/dev.c:5801
 __do_softirq+0x56d/0x93d kernel/softirq.c:285
 invoke_softirq kernel/softirq.c:365 [inline]
 irq_exit+0x202/0x240 kernel/softirq.c:405
 exiting_irq+0xe/0x10 arch/x86/include/asm/apic.h:525
 smp_apic_timer_interrupt+0x64/0x90 arch/x86/kernel/apic/apic.c:1055
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:863
 </IRQ>
RIP: 0010:native_restore_fl arch/x86/include/asm/irqflags.h:37 [inline]
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/irqflags.h:78 [inline]
RIP: 0010:__msan_poison_alloca+0x14c/0x1d0 mm/kmsan/kmsan_instr.c:652
RSP: 0018:ffff8801a9cff140 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 0000000092a00096 RBX: 0000000092a00096 RCX: ffff8801a9cff180
RDX: 0000000000000004 RSI: 0000000000000004 RDI: 0000000047d06839
RBP: ffff8801a9cff1d8 R08: 0000000001080020 R09: 0000000000000002
R10: 0000000000000002 R11: 0000000000000000 R12: 0000000000000000
R13: ffffffff8af44350 R14: 0000000000000246 R15: ffff8801ce511d40
 fib_nl_fill_rule+0x178/0x1f50 net/core/fib_rules.c:891
 notify_rule_change+0x257/0x460 net/core/fib_rules.c:1045
 fib_nl_newrule+0x47d1/0x49b0 net/core/fib_rules.c:675
 rtnetlink_rcv_msg+0xa32/0x1560 net/core/rtnetlink.c:4646
 netlink_rcv_skb+0x378/0x600 net/netlink/af_netlink.c:2448
 rtnetlink_rcv+0x50/0x60 net/core/rtnetlink.c:4664
 netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
 netlink_unicast+0x166b/0x1740 net/netlink/af_netlink.c:1336
 netlink_sendmsg+0x1072/0x1370 net/netlink/af_netlink.c:1901
 sock_sendmsg_nosec net/socket.c:629 [inline]
 sock_sendmsg net/socket.c:639 [inline]
 ___sys_sendmsg+0xec0/0x1310 net/socket.c:2117
 __sys_sendmsg net/socket.c:2155 [inline]
 __do_sys_sendmsg net/socket.c:2164 [inline]
 __se_sys_sendmsg net/socket.c:2162 [inline]
 __x64_sys_sendmsg+0x331/0x460 net/socket.c:2162
 do_syscall_64+0x154/0x220 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x440049
RSP: 002b:00007ffdd28a01f8 EFLAGS: 00000217 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440049
RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000009
RBP: 00000000006ca018 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000217 R12: 0000000000401970
R13: 0000000000401a00 R14: 0000000000000000 R15: 0000000000000000

Local variable description: ----fl4.i@fib_validate_source
Variable was created at:
 fib_validate_source+0x127/0x1d50 net/ipv4/fib_frontend.c:410
 ip_route_input_slow net/ipv4/route.c:1978 [inline]
 ip_route_input_rcu+0x3592/0x6280 net/ipv4/route.c:2152
==================================================================

Crashes (124):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/05/21 12:42 https://github.com/google/kmsan.git master 9f127b7ceaf7 f48c20b8 .config console log report syz C ci-upstream-kmsan-gce
2018/06/07 07:16 https://github.com/google/kmsan.git master b9a5d319699c e0e534c6 .config console log report ci-upstream-kmsan-gce
2018/06/06 21:00 https://github.com/google/kmsan.git master b9a5d319699c e0e534c6 .config console log report ci-upstream-kmsan-gce
2018/06/06 06:57 https://github.com/google/kmsan.git master 8fc8ecd1c58a 863a24bb .config console log report ci-upstream-kmsan-gce
2018/06/05 21:29 https://github.com/google/kmsan.git master 8fc8ecd1c58a 863a24bb .config console log report ci-upstream-kmsan-gce
2018/06/05 13:14 https://github.com/google/kmsan.git master 8fc8ecd1c58a a316ff92 .config console log report ci-upstream-kmsan-gce
2018/06/05 09:13 https://github.com/google/kmsan.git master 8fc8ecd1c58a a316ff92 .config console log report ci-upstream-kmsan-gce
2018/06/05 00:29 https://github.com/google/kmsan.git master 8fc8ecd1c58a a50d873b .config console log report ci-upstream-kmsan-gce
2018/06/04 19:24 https://github.com/google/kmsan.git master 8fc8ecd1c58a 6cbe7c26 .config console log report ci-upstream-kmsan-gce
2018/06/04 07:31 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/06/04 06:17 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/06/03 18:10 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/06/03 13:57 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/06/03 08:05 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/06/03 03:41 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/06/03 01:13 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/06/02 23:51 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/06/02 12:37 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/06/02 09:21 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/06/02 08:19 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/06/02 05:17 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/06/02 00:23 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/06/01 17:15 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/06/01 14:34 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/06/01 11:07 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/06/01 09:18 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/06/01 05:42 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/06/01 03:37 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/05/30 15:39 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/05/30 10:56 https://github.com/google/kmsan.git master 8fc8ecd1c58a 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/05/30 09:02 https://github.com/google/kmsan.git master 1b9cd4eccac9 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/05/30 01:43 https://github.com/google/kmsan.git master 1b9cd4eccac9 2f93b54f .config console log report ci-upstream-kmsan-gce
2018/05/29 20:58 https://github.com/google/kmsan.git master 1b9cd4eccac9 e276de77 .config console log report ci-upstream-kmsan-gce
2018/05/29 12:31 https://github.com/google/kmsan.git master 1b9cd4eccac9 e276de77 .config console log report ci-upstream-kmsan-gce
2018/05/29 10:52 https://github.com/google/kmsan.git master 1b9cd4eccac9 f48c20b8 .config console log report ci-upstream-kmsan-gce
2018/05/29 08:06 https://github.com/google/kmsan.git master 1b9cd4eccac9 f48c20b8 .config console log report ci-upstream-kmsan-gce
2018/05/29 04:45 https://github.com/google/kmsan.git master 1b9cd4eccac9 f48c20b8 .config console log report ci-upstream-kmsan-gce
2018/05/28 23:59 https://github.com/google/kmsan.git master 1b9cd4eccac9 f48c20b8 .config console log report ci-upstream-kmsan-gce
2018/05/28 22:43 https://github.com/google/kmsan.git master 1b9cd4eccac9 f48c20b8 .config console log report ci-upstream-kmsan-gce
2018/05/28 20:44 https://github.com/google/kmsan.git master 1b9cd4eccac9 f48c20b8 .config console log report ci-upstream-kmsan-gce
2018/05/28 09:10 https://github.com/google/kmsan.git master 1b9cd4eccac9 f48c20b8 .config console log report ci-upstream-kmsan-gce
2018/05/16 09:00 https://github.com/google/kmsan.git master 06b2df0593a8 75b2448a .config console log report ci-upstream-kmsan-gce
* Struck through repros no longer work on HEAD.