syzbot


KMSAN: uninit-value in hci_conn_complete_evt

Status: auto-closed as invalid on 2022/05/29 00:45
Subsystems: bluetooth
[Documentation on labels]
Reported-by: syzbot+dcb7d98a388eafb85ecb@syzkaller.appspotmail.com
First crash: 885d, last: 818d
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] KMSAN: uninit-value in hci_conn_complete_evt 0 (1) 2021/11/28 09:22
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in hci_cmd_status_evt bluetooth 1 837d 837d 0/26 auto-closed as invalid on 2022/04/10 18:57

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in hci_conn_hash_lookup_ba include/net/bluetooth/hci_core.h:1026 [inline]
BUG: KMSAN: uninit-value in hci_conn_complete_evt+0x2fd/0x1e00 net/bluetooth/hci_event.c:2701
 hci_conn_hash_lookup_ba include/net/bluetooth/hci_core.h:1026 [inline]
 hci_conn_complete_evt+0x2fd/0x1e00 net/bluetooth/hci_event.c:2701
 hci_event_packet+0x183a/0x23e0 net/bluetooth/hci_event.c:6356
 hci_rx_work+0x6a0/0xd00 net/bluetooth/hci_core.c:5084
 process_one_work+0xdb9/0x1820 kernel/workqueue.c:2298
 worker_thread+0x10bc/0x21f0 kernel/workqueue.c:2445
 kthread+0x721/0x850 kernel/kthread.c:327
 ret_from_fork+0x1f/0x30

Uninit was created at:
 slab_post_alloc_hook mm/slab.h:524 [inline]
 slab_alloc_node mm/slub.c:3251 [inline]
 __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974
 kmalloc_reserve net/core/skbuff.c:354 [inline]
 __alloc_skb+0x545/0xf90 net/core/skbuff.c:426
 alloc_skb include/linux/skbuff.h:1126 [inline]
 bt_skb_alloc include/net/bluetooth/bluetooth.h:413 [inline]
 vhci_get_user drivers/bluetooth/hci_vhci.c:287 [inline]
 vhci_write+0x187/0x8f0 drivers/bluetooth/hci_vhci.c:407
 call_write_iter include/linux/fs.h:2162 [inline]
 new_sync_write fs/read_write.c:503 [inline]
 vfs_write+0x1318/0x2030 fs/read_write.c:590
 ksys_write+0x28b/0x510 fs/read_write.c:643
 __do_sys_write fs/read_write.c:655 [inline]
 __se_sys_write fs/read_write.c:652 [inline]
 __x64_sys_write+0xdb/0x120 fs/read_write.c:652
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x44/0xae

CPU: 1 PID: 3498 Comm: kworker/u5:1 Not tainted 5.16.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: hci3 hci_rx_work
=====================================================

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/01/29 00:44 https://github.com/google/kmsan.git master 85cfd6e539bd 495e00c5 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in hci_conn_complete_evt
2021/11/27 12:44 https://github.com/google/kmsan.git master a535b0caaa2f 63eeac02 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in hci_conn_complete_evt
2021/11/23 21:17 https://github.com/google/kmsan.git master 7ca3114e5a48 545ab074 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in hci_conn_complete_evt
* Struck through repros no longer work on HEAD.