syzbot

 sign-in | mailing list | source | docs
🐞 Open [1656]
≡ Subsystems
🐞 Fixed [6096]
🐞 Invalid [15188]
⬇ Missing Backports [163]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
💬 Send us feedback

KMSAN: uninit-value in ipv6_skip_exthdr (2)

Status: closed as invalid on 2018/07/10 13:48
Subsystems: netfilter
[Documentation on labels]
First crash: 2441d, last: 2441d
▶ ▼ Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in ipv6_skip_exthdr net C 15 2521d 2522d 0/28 closed as invalid on 2018/04/21 17:53

Sample crash report:
random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
IPVS: ftp: loaded support on port[0] = 21
==================================================================
BUG: KMSAN: uninit-value in ipv6_ext_hdr net/ipv6/exthdrs_core.c:17 [inline]
BUG: KMSAN: uninit-value in ipv6_skip_exthdr+0x156/0x910 net/ipv6/exthdrs_core.c:78
CPU: 0 PID: 4596 Comm: syz-executor935 Not tainted 4.18.0-rc4+ #23
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x185/0x1e0 lib/dump_stack.c:113
 kmsan_report+0x195/0x2c0 mm/kmsan/kmsan.c:990
 __msan_warning_32+0x7d/0xe0 mm/kmsan/kmsan_instr.c:640
 ipv6_ext_hdr net/ipv6/exthdrs_core.c:17 [inline]
 ipv6_skip_exthdr+0x156/0x910 net/ipv6/exthdrs_core.c:78
 ipv6_get_l4proto+0x1be/0x2f0 net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c:83
 nf_conntrack_in+0x54a/0x2070 net/netfilter/nf_conntrack_core.c:1388
 ipv6_conntrack_in+0xc3/0xf0 net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c:172
 nf_hook_entry_hookfn include/linux/netfilter.h:119 [inline]
 nf_hook_slow+0x15d/0x3e0 net/netfilter/core.c:511
 nf_hook include/linux/netfilter.h:242 [inline]
 NF_HOOK include/linux/netfilter.h:285 [inline]
 ipv6_rcv+0x1df5/0x2250 net/ipv6/ip6_input.c:208
 __netif_receive_skb_core+0x4a7a/0x4fc0 net/core/dev.c:4628
 __netif_receive_skb net/core/dev.c:4693 [inline]
 netif_receive_skb_internal+0x475/0x660 net/core/dev.c:4767
 napi_frags_finish net/core/dev.c:5208 [inline]
 napi_gro_frags+0xfb4/0x1600 net/core/dev.c:5281
 tun_get_user+0x5a3b/0x89c0 drivers/net/tun.c:1964
 tun_chr_write_iter+0x1d4/0x330 drivers/net/tun.c:2009
 do_iter_readv_writev+0x81a/0xac0 include/linux/fs.h:1787
 do_iter_write+0x30d/0xd50 fs/read_write.c:959
 vfs_writev fs/read_write.c:1004 [inline]
 do_writev+0x3d8/0x860 fs/read_write.c:1039
 __do_sys_writev fs/read_write.c:1112 [inline]
 __se_sys_writev fs/read_write.c:1109 [inline]
 __x64_sys_writev+0xe1/0x120 fs/read_write.c:1109
 do_syscall_64+0x15b/0x230 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x63/0xe7
RIP: 0033:0x441570
Code: 05 48 3d 01 f0 ff ff 0f 83 bd 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 83 3d 81 27 29 00 00 75 14 b8 14 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 94 09 fc ff c3 48 83 ec 08 e8 3a 2b 00 00 
RSP: 002b:00007ffe4bffac48 EFLAGS: 00000246 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000441570
RDX: 0000000000000001 RSI: 00007ffe4bffac70 RDI: 00000000000000fc
RBP: 00000000006cc018 R08: 0000000000000000 R09: 000000000000001a
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000402390
R13: 0000000000402420 R14: 0000000000000000 R15: 0000000000000000

Uninit was stored to memory at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:256 [inline]
 kmsan_save_stack mm/kmsan/kmsan.c:271 [inline]
 kmsan_internal_chain_origin+0x13c/0x240 mm/kmsan/kmsan.c:581
 kmsan_memcpy_origins+0x11d/0x170 mm/kmsan/kmsan.c:425
 __msan_memcpy+0xe7/0x150 mm/kmsan/kmsan_instr.c:432
 skb_copy_from_linear_data_offset include/linux/skbuff.h:3385 [inline]
 skb_copy_bits+0x1f9/0xd80 net/core/skbuff.c:2038
 ipv6_get_l4proto+0x105/0x2f0 net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c:78
 nf_conntrack_in+0x54a/0x2070 net/netfilter/nf_conntrack_core.c:1388
 ipv6_conntrack_in+0xc3/0xf0 net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c:172
 nf_hook_entry_hookfn include/linux/netfilter.h:119 [inline]
 nf_hook_slow+0x15d/0x3e0 net/netfilter/core.c:511
 nf_hook include/linux/netfilter.h:242 [inline]
 NF_HOOK include/linux/netfilter.h:285 [inline]
 ipv6_rcv+0x1df5/0x2250 net/ipv6/ip6_input.c:208
 __netif_receive_skb_core+0x4a7a/0x4fc0 net/core/dev.c:4628
 __netif_receive_skb net/core/dev.c:4693 [inline]
 netif_receive_skb_internal+0x475/0x660 net/core/dev.c:4767
 napi_frags_finish net/core/dev.c:5208 [inline]
 napi_gro_frags+0xfb4/0x1600 net/core/dev.c:5281
 tun_get_user+0x5a3b/0x89c0 drivers/net/tun.c:1964
 tun_chr_write_iter+0x1d4/0x330 drivers/net/tun.c:2009
 do_iter_readv_writev+0x81a/0xac0 include/linux/fs.h:1787
 do_iter_write+0x30d/0xd50 fs/read_write.c:959
 vfs_writev fs/read_write.c:1004 [inline]
 do_writev+0x3d8/0x860 fs/read_write.c:1039
 __do_sys_writev fs/read_write.c:1112 [inline]
 __se_sys_writev fs/read_write.c:1109 [inline]
 __x64_sys_writev+0xe1/0x120 fs/read_write.c:1109
 do_syscall_64+0x15b/0x230 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x63/0xe7

Uninit was stored to memory at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:256 [inline]
 kmsan_save_stack mm/kmsan/kmsan.c:271 [inline]
 kmsan_internal_chain_origin+0x13c/0x240 mm/kmsan/kmsan.c:581
 kmsan_memcpy_origins+0x11d/0x170 mm/kmsan/kmsan.c:425
 kmsan_memmove_origins+0x9/0x10 mm/kmsan/kmsan.c:480
 __msan_memmove+0xe7/0x150 mm/kmsan/kmsan_instr.c:381
 nf_ct_frag6_reasm net/ipv6/netfilter/nf_conntrack_reasm.c:432 [inline]
 nf_ct_frag6_gather+0x436a/0x5870 net/ipv6/netfilter/nf_conntrack_reasm.c:586
 ipv6_defrag+0x501/0x5c0 net/ipv6/netfilter/nf_defrag_ipv6_hooks.c:71
 nf_hook_entry_hookfn include/linux/netfilter.h:119 [inline]
 nf_hook_slow+0x15d/0x3e0 net/netfilter/core.c:511
 nf_hook include/linux/netfilter.h:242 [inline]
 NF_HOOK include/linux/netfilter.h:285 [inline]
 ipv6_rcv+0x1df5/0x2250 net/ipv6/ip6_input.c:208
 __netif_receive_skb_core+0x4a7a/0x4fc0 net/core/dev.c:4628
 __netif_receive_skb net/core/dev.c:4693 [inline]
 netif_receive_skb_internal+0x475/0x660 net/core/dev.c:4767
 napi_frags_finish net/core/dev.c:5208 [inline]
 napi_gro_frags+0xfb4/0x1600 net/core/dev.c:5281
 tun_get_user+0x5a3b/0x89c0 drivers/net/tun.c:1964
 tun_chr_write_iter+0x1d4/0x330 drivers/net/tun.c:2009
 do_iter_readv_writev+0x81a/0xac0 include/linux/fs.h:1787
 do_iter_write+0x30d/0xd50 fs/read_write.c:959
 vfs_writev fs/read_write.c:1004 [inline]
 do_writev+0x3d8/0x860 fs/read_write.c:1039
 __do_sys_writev fs/read_write.c:1112 [inline]
 __se_sys_writev fs/read_write.c:1109 [inline]
 __x64_sys_writev+0xe1/0x120 fs/read_write.c:1109
 do_syscall_64+0x15b/0x230 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x63/0xe7

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:256 [inline]
 kmsan_internal_alloc_meta_for_pages+0x157/0x730 mm/kmsan/kmsan.c:702
 kmsan_alloc_page+0x80/0xe0 mm/kmsan/kmsan_hooks.c:250
 __alloc_pages_nodemask+0x105b/0x6320 mm/page_alloc.c:4409
 __alloc_pages include/linux/gfp.h:458 [inline]
 __alloc_pages_node include/linux/gfp.h:471 [inline]
 alloc_pages_node include/linux/gfp.h:485 [inline]
 __page_frag_cache_refill mm/page_alloc.c:4485 [inline]
 page_frag_alloc+0x444/0x9d0 mm/page_alloc.c:4521
 __napi_alloc_skb+0x199/0xa10 net/core/skbuff.c:479
 napi_alloc_skb include/linux/skbuff.h:2658 [inline]
 page_to_skb+0x14a/0x1230 drivers/net/virtio_net.c:359
 receive_mergeable drivers/net/virtio_net.c:862 [inline]
 receive_buf+0x1203/0x7900 drivers/net/virtio_net.c:968
 virtnet_receive drivers/net/virtio_net.c:1252 [inline]
 virtnet_poll+0x903/0x1490 drivers/net/virtio_net.c:1334
 napi_poll net/core/dev.c:5771 [inline]
 net_rx_action+0x799/0x1ae0 net/core/dev.c:5837
 __do_softirq+0x55f/0x934 kernel/softirq.c:288
==================================================================

Crashes (55):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/07/10 01:05 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report syz C ci-upstream-kmsan-gce
2018/07/10 11:34 https://github.com/google/kmsan.git master 85c225c088f5 9fa03fa5 .config console log report ci-upstream-kmsan-gce
2018/07/10 10:17 https://github.com/google/kmsan.git master 85c225c088f5 9fa03fa5 .config console log report ci-upstream-kmsan-gce
2018/07/10 09:16 https://github.com/google/kmsan.git master 85c225c088f5 9fa03fa5 .config console log report ci-upstream-kmsan-gce
2018/07/10 07:54 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/10 07:04 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/10 06:03 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/10 05:43 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/10 05:24 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/10 05:14 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/10 03:29 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/10 03:27 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/10 03:02 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/10 02:55 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/10 02:50 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/10 01:46 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/10 01:42 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/10 01:36 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/10 01:22 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/10 01:01 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/10 00:38 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/10 00:31 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/10 00:26 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/10 00:26 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/10 00:22 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/10 00:20 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/10 00:10 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/10 00:06 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/09 23:49 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/09 23:43 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/09 23:36 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/09 21:56 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/09 21:22 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/09 18:54 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/09 18:53 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/09 18:53 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/09 18:52 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/09 18:52 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/09 18:47 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/09 18:42 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/09 18:35 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/09 18:20 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/09 18:19 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
2018/07/09 18:11 https://github.com/google/kmsan.git master 85c225c088f5 f25e5770 .config console log report ci-upstream-kmsan-gce
* Struck through repros no longer work on HEAD.