syzbot


KMSAN: uninit-value in get_stack_info (3)

Status: auto-closed as invalid on 2021/03/01 22:48
Subsystems: kernel
[Documentation on labels]
First crash: 1241d, last: 1241d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in number (4) kernel C 7189 520d 898d 0/26 closed as invalid on 2022/11/28 10:01
upstream KMSAN: uninit-value in get_stack_info (2) kernel 128 1994d 1994d 0/26 auto-closed as invalid on 2019/05/08 18:35
upstream KMSAN: uninit-value in get_stack_info kernel 49 1994d 1994d 0/26 closed as invalid on 2018/11/09 09:17

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in get_stack_info+0x368/0x470 arch/x86/kernel/dumpstack_64.c:196
CPU: 1 PID: 182 Comm: kworker/u4:4 Not tainted 5.10.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: netns cleanup_net
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x21c/0x280 lib/dump_stack.c:118
 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118
 __msan_warning+0x5f/0xa0 mm/kmsan/kmsan_instr.c:197
 get_stack_info+0x368/0x470 arch/x86/kernel/dumpstack_64.c:196
 __unwind_start+0x37c/0x790 arch/x86/kernel/unwind_frame.c:395
 unwind_start arch/x86/include/asm/unwind.h:61 [inline]
 arch_stack_walk+0x23d/0x3c0 arch/x86/kernel/stacktrace.c:24
 stack_trace_save+0x117/0x1a0 kernel/stacktrace.c:121
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:121 [inline]
 kmsan_internal_chain_origin+0xad/0x130 mm/kmsan/kmsan.c:289
 kmsan_memcpy_memmove_metadata+0x25e/0x2d0 mm/kmsan/kmsan.c:226
 kmsan_memcpy_metadata+0xb/0x10 mm/kmsan/kmsan.c:246
 __msan_memcpy+0x46/0x60 mm/kmsan/kmsan_instr.c:110
 skb_copy_from_linear_data_offset include/linux/skbuff.h:3660 [inline]
 skb_copy_bits+0x2a6/0x1050 net/core/skbuff.c:2195
 skb_copy+0x51e/0xb40 net/core/skbuff.c:1518
 mac80211_hwsim_tx_frame_no_nl+0x1efe/0x2b40 drivers/net/wireless/mac80211_hwsim.c:1493
 mac80211_hwsim_tx_frame+0x34d/0x370 drivers/net/wireless/mac80211_hwsim.c:1705
 mac80211_hwsim_beacon_tx+0x9bd/0xd30 drivers/net/wireless/mac80211_hwsim.c:1759
 __iterate_interfaces+0x525/0x7e0 net/mac80211/util.c:792
 ieee80211_iterate_active_interfaces_atomic+0xbb/0xd0 net/mac80211/util.c:828
 mac80211_hwsim_beacon+0x11d/0x2e0 drivers/net/wireless/mac80211_hwsim.c:1782
 __run_hrtimer+0x48b/0xd20 kernel/time/hrtimer.c:1519
 __hrtimer_run_queues kernel/time/hrtimer.c:1583 [inline]
 hrtimer_run_softirq+0x3bf/0x690 kernel/time/hrtimer.c:1600
 __do_softirq+0x1a9/0x6fa kernel/softirq.c:298
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x6e/0x90 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:393 [inline]
 __irq_exit_rcu+0x226/0x270 kernel/softirq.c:423
 irq_exit_rcu+0xe/0x10 kernel/softirq.c:435
 sysvec_apic_timer_interrupt+0x106/0x130 arch/x86/kernel/apic/apic.c:1091
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:inet_twsk_purge+0xb12/0xb80 net/ipv4/inet_timewait_sock.c:264
Code: 0f 1f 84 00 00 00 00 00 e8 6b a0 77 f4 48 83 bd 68 ff ff ff 00 75 4b 48 8b 9d 48 ff ff ff ff c3 48 8b bd 58 ff ff ff 44 8b 3f <e8> 79 08 1b f5 83 38 00 75 38 44 39 fb 77 3f e8 ba e6 9b f4 48 89
RSP: 0018:ffff888102e03ad0 EFLAGS: 00000206
RAX: ffff8881044928c0 RBX: 00000000000215aa RCX: 00000000000215a9
RDX: ffff888104491ec0 RSI: 00000000000215a9 RDI: ffffffff91eab810
RBP: ffff888102e03b98 R08: ffffffff8d1b6f2e R09: ffff88813fffa000
R10: 0000000000000000 R11: 0000000000000000 R12: 00000000000215a9
R13: 00000000072e00af R14: ffff8881044928c0 R15: 000000000007ffff
 dccp_v4_exit_batch+0x31/0x40 net/dccp/ipv4.c:1022
 ops_exit_list net/core/net_namespace.c:190 [inline]
 cleanup_net+0xf0e/0x1af0 net/core/net_namespace.c:604
 process_one_work+0x121c/0x1fc0 kernel/workqueue.c:2272
 worker_thread+0x10cc/0x2740 kernel/workqueue.c:2418
 kthread+0x51c/0x560 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296

Local variable ----regs@__bpf_prog_run32 created at:
 __bpf_prog_run32+0x84/0x190 kernel/bpf/core.c:1697
 __bpf_prog_run32+0x84/0x190 kernel/bpf/core.c:1697
=====================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/12/01 22:44 https://github.com/google/kmsan.git master 73d62e81b476 07bfe8a5 .config console log report info ci-upstream-kmsan-gce-386
* Struck through repros no longer work on HEAD.