syzbot


KMSAN: uninit-value in inet_gso_segment

Status: closed as invalid on 2018/09/05 11:10
Subsystems: net
[Documentation on labels]
First crash: 2404d, last: 2404d

Sample crash report:
==================================================================
BUG: KMSAN: uninit-value in inet_gso_segment+0x433/0x1c10 net/ipv4/af_inet.c:1308
CPU: 1 PID: 21201 Comm: syz-executor5 Not tainted 4.17.0+ #9
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x185/0x1d0 lib/dump_stack.c:113
 kmsan_report+0x188/0x2a0 mm/kmsan/kmsan.c:1125
 __msan_warning_32+0x70/0xc0 mm/kmsan/kmsan_instr.c:620
 inet_gso_segment+0x433/0x1c10 net/ipv4/af_inet.c:1308
 ipv6_gso_segment+0x115c/0x1d90 net/ipv6/ip6_offload.c:98
 skb_mac_gso_segment+0x420/0x7b0 net/core/dev.c:2793
 nsh_gso_segment+0x658/0x1340 net/nsh/nsh.c:111
 skb_mac_gso_segment+0x420/0x7b0 net/core/dev.c:2793
 __skb_gso_segment+0x757/0xa40 net/core/dev.c:2866
 skb_gso_segment include/linux/netdevice.h:4038 [inline]
 validate_xmit_skb+0xc30/0x1320 net/core/dev.c:3119
 __dev_queue_xmit+0x2370/0x3540 net/core/dev.c:3576
 dev_queue_xmit+0x4b/0x60 net/core/dev.c:3617
 packet_snd net/packet/af_packet.c:2953 [inline]
 packet_sendmsg+0x818b/0x8cc0 net/packet/af_packet.c:2978
 sock_sendmsg_nosec net/socket.c:629 [inline]
 sock_sendmsg net/socket.c:639 [inline]
 __sys_sendto+0x6c4/0x7e0 net/socket.c:1789
 __do_sys_sendto net/socket.c:1801 [inline]
 __se_sys_sendto net/socket.c:1797 [inline]
 __x64_sys_sendto+0x1a1/0x210 net/socket.c:1797
 do_syscall_64+0x15b/0x230 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x455a99
RSP: 002b:00007f2463409c68 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f246340a6d4 RCX: 0000000000455a99
RDX: 0000000000000012 RSI: 0000000020000000 RDI: 0000000000000013
RBP: 000000000072bea0 R08: 00000000200000c0 R09: 000000000000001c
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 00000000004c0efd R14: 00000000004d0e00 R15: 0000000000000000

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:282 [inline]
 kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:192
 kmsan_kmalloc+0x94/0x100 mm/kmsan/kmsan.c:318
 kmsan_slab_alloc+0x10/0x20 mm/kmsan/kmsan.c:325
 slab_post_alloc_hook mm/slab.h:446 [inline]
 slab_alloc_node mm/slub.c:2753 [inline]
 __kmalloc_node_track_caller+0xb35/0x11b0 mm/slub.c:4395
 __kmalloc_reserve net/core/skbuff.c:138 [inline]
 __alloc_skb+0x2cb/0x9e0 net/core/skbuff.c:206
 alloc_skb include/linux/skbuff.h:988 [inline]
 _sctp_make_chunk+0xf6/0x8f0 net/sctp/sm_make_chunk.c:1417
 sctp_make_data net/sctp/sm_make_chunk.c:1449 [inline]
 sctp_make_datafrag_empty+0x21e/0x6f0 net/sctp/sm_make_chunk.c:768
 sctp_datamsg_from_user+0x121a/0x1f10 net/sctp/chunk.c:283
 sctp_sendmsg_to_asoc+0x173d/0x2690 net/sctp/socket.c:1950
 sctp_sendmsg+0x3c41/0x5fc0 net/sctp/socket.c:2122
 inet_sendmsg+0x3fc/0x760 net/ipv4/af_inet.c:798
 sock_sendmsg_nosec net/socket.c:629 [inline]
 sock_sendmsg net/socket.c:639 [inline]
 __sys_sendto+0x6c4/0x7e0 net/socket.c:1789
 __do_sys_sendto net/socket.c:1801 [inline]
 __se_sys_sendto net/socket.c:1797 [inline]
 __x64_sys_sendto+0x1a1/0x210 net/socket.c:1797
 do_syscall_64+0x15b/0x230 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
==================================================================
sd 0:0:1:0: [sg0] tag#8000 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/06/30 23:14 https://github.com/google/kmsan.git master 123906095e30 dba0b50e .config console log report ci-upstream-kmsan-gce
* Struck through repros no longer work on HEAD.