syzbot


KMSAN: uninit-value in batadv_purge_outstanding_packets

Status: closed as invalid on 2025/02/20 16:21
Subsystems: batman
[Documentation on labels]
First crash: 203d, last: 203d

Sample crash report:
hsr_slave_0: left promiscuous mode
hsr_slave_1: left promiscuous mode
batman_adv: batadv0: Interface deactivated: batadv_slave_0
batman_adv: batadv0: Removing interface: batadv_slave_0
=====================================================
BUG: KMSAN: uninit-value in batadv_forw_packet_list_steal net/batman-adv/send.c:619 [inline]
BUG: KMSAN: uninit-value in batadv_purge_outstanding_packets+0x669/0xd30 net/batman-adv/send.c:1129
 batadv_forw_packet_list_steal net/batman-adv/send.c:619 [inline]
 batadv_purge_outstanding_packets+0x669/0xd30 net/batman-adv/send.c:1129
 batadv_hardif_disable_interface+0xf6c/0x1dd0 net/batman-adv/hard-interface.c:853
 batadv_softif_destroy_netlink+0x116/0x8d0 net/batman-adv/soft-interface.c:1121
 default_device_exit_batch+0x12d6/0x1590 net/core/dev.c:12355
 ops_exit_list net/core/net_namespace.c:177 [inline]
 cleanup_net+0x1113/0x1d20 net/core/net_namespace.c:652
 process_one_work kernel/workqueue.c:3236 [inline]
 process_scheduled_works+0xae0/0x1c40 kernel/workqueue.c:3317
 worker_thread+0xea7/0x14f0 kernel/workqueue.c:3398
 kthread+0x6b9/0xef0 kernel/kthread.c:464
 ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Uninit was created at:
 slab_post_alloc_hook mm/slub.c:4121 [inline]
 slab_alloc_node mm/slub.c:4164 [inline]
 __do_kmalloc_node mm/slub.c:4293 [inline]
 __kmalloc_node_track_caller_noprof+0x945/0x1240 mm/slub.c:4313
 kmemdup_noprof mm/util.c:135 [inline]
 kmemdup_array+0x5c/0xd0 mm/util.c:155
 nf_nat_register_fn+0x44f/0x9c0 net/netfilter/nf_nat_core.c:1221
 nf_nat_ipv6_register_fn+0x5e/0x80 net/netfilter/nf_nat_proto.c:1122
 ip6t_nat_register_lookups net/ipv6/netfilter/ip6table_nat.c:79 [inline]
 ip6table_nat_table_init+0x24e/0x820 net/ipv6/netfilter/ip6table_nat.c:123
 xt_find_table_lock+0x456/0x840 net/netfilter/x_tables.c:1260
 xt_request_find_table_lock+0x4c/0x1e0 net/netfilter/x_tables.c:1285
 get_info net/ipv6/netfilter/ip6_tables.c:979 [inline]
 do_ip6t_get_ctl+0x16f2/0x20b0 net/ipv6/netfilter/ip6_tables.c:1668
 nf_getsockopt+0x429/0x480 net/netfilter/nf_sockopt.c:116
 ipv6_getsockopt+0x331/0x4c0 net/ipv6/ipv6_sockglue.c:1493
 tcp_getsockopt+0x15c/0x1a0 net/ipv4/tcp.c:4671
 sock_common_getsockopt+0xa1/0xe0 net/core/sock.c:3810
 do_sock_getsockopt+0x5f0/0xa10 net/socket.c:2359
 __sys_getsockopt net/socket.c:2388 [inline]
 __do_sys_getsockopt net/socket.c:2395 [inline]
 __se_sys_getsockopt net/socket.c:2392 [inline]
 __x64_sys_getsockopt+0x449/0x590 net/socket.c:2392
 x64_sys_call+0x1554/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:56
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 0 UID: 0 PID: 3710 Comm: kworker/u8:13 Not tainted 6.13.0-syzkaller-09338-g05dbaf8dd8bf #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Workqueue: netns cleanup_net
=====================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/01/29 23:20 upstream 05dbaf8dd8bf afe4eff5 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in batadv_purge_outstanding_packets
* Struck through repros no longer work on HEAD.