syzbot


KMSAN: uninit-value in l2cap_sock_teardown_cb

Status: auto-closed as invalid on 2021/04/20 16:11
Subsystems: bluetooth
[Documentation on labels]
First crash: 1185d, last: 1185d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in l2cap_sock_teardown_cb (2) bluetooth 1 1062d 1062d 0/26 auto-closed as invalid on 2021/09/03 00:26

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in l2cap_sock_teardown_cb+0x840/0x890 net/bluetooth/l2cap_sock.c:1541
CPU: 1 PID: 32 Comm: kworker/1:1 Not tainted 5.10.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events l2cap_chan_timeout
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x21c/0x280 lib/dump_stack.c:118
 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118
 __msan_warning+0x5f/0xa0 mm/kmsan/kmsan_instr.c:197
 l2cap_sock_teardown_cb+0x840/0x890 net/bluetooth/l2cap_sock.c:1541
 l2cap_chan_del+0x3e3/0x1d50 net/bluetooth/l2cap_core.c:618
 l2cap_chan_close+0xeea/0x1050 net/bluetooth/l2cap_core.c:823
 l2cap_chan_timeout+0x1da/0x590 net/bluetooth/l2cap_core.c:436
 process_one_work+0x1219/0x1fe0 kernel/workqueue.c:2272
 worker_thread+0x123c/0x2730 kernel/workqueue.c:2418
 kthread+0x51c/0x560 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:121 [inline]
 kmsan_internal_poison_shadow+0x5c/0xf0 mm/kmsan/kmsan.c:104
 kmsan_slab_alloc+0x8d/0xe0 mm/kmsan/kmsan_hooks.c:76
 slab_alloc_node mm/slub.c:2906 [inline]
 __kmalloc_node+0xa33/0x15e0 mm/slub.c:4031
 kmalloc_node include/linux/slab.h:575 [inline]
 kvmalloc_node+0x201/0x3d0 mm/util.c:575
 kvmalloc include/linux/mm.h:765 [inline]
 xt_alloc_table_info+0xce/0x1c0 net/netfilter/x_tables.c:1176
 translate_compat_table net/ipv6/netfilter/ip6_tables.c:1442 [inline]
 compat_do_replace net/ipv6/netfilter/ip6_tables.c:1526 [inline]
 do_ip6t_set_ctl+0x2995/0x5670 net/ipv6/netfilter/ip6_tables.c:1633
 nf_setsockopt+0x59e/0x600 net/netfilter/nf_sockopt.c:101
 ipv6_setsockopt+0x98dc/0xaed0 net/ipv6/ipv6_sockglue.c:1008
 tcp_setsockopt+0x239/0x270 net/ipv4/tcp.c:3338
 sock_common_setsockopt+0x16c/0x1b0 net/core/sock.c:3235
 __sys_setsockopt+0x95c/0xda0 net/socket.c:2132
 __do_compat_sys_socketcall net/compat.c:492 [inline]
 __se_compat_sys_socketcall+0xcc2/0x16b0 net/compat.c:424
 __ia32_compat_sys_socketcall+0x3e/0x60 net/compat.c:424
 do_syscall_32_irqs_on arch/x86/entry/common.c:80 [inline]
 __do_fast_syscall_32+0x102/0x160 arch/x86/entry/common.c:139
 do_fast_syscall_32+0x6a/0xc0 arch/x86/entry/common.c:162
 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:205
 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c
=====================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/01/20 16:09 https://github.com/google/kmsan.git master 73d62e81b476 d4f4eca5 .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in l2cap_sock_teardown_cb
* Struck through repros no longer work on HEAD.