syzbot


KMSAN: uninit-value in ip_rcv_core

Status: fixed on 2021/11/10 00:50
Reported-by: syzbot+2e406a9ac75bb71d4b7a@syzkaller.appspotmail.com
Fix commit: 6628ddfec758 net: geneve: check skb is large enough for IPv4/IPv6 header
First crash: 1429d, last: 387d
similar bugs (1):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in ip_rcv_core (2) 1 223d 216d 0/23 auto-closed as invalid on 2022/03/27 07:55
Patch testing requests:
Created Duration User Patch Repo Result
2021/04/22 23:16 23m phil@philpotter.co.uk patch https://github.com/google/kmsan.git master OK
2021/04/22 21:45 0m phil@philpotter.co.uk patch https://github.com/google/kmsan.git master error
2021/04/21 22:36 23m phil@philpotter.co.uk patch https://github.com/google/kmsan.git master OK
2021/04/21 16:30 22m phil@philpotter.co.uk patch https://github.com/google/kmsan.git master OK
2021/04/21 16:16 0m phil@philpotter.co.uk patch https://github.com/google/kmsan.git master error
2021/04/10 23:20 44m phil@philpotter.co.uk patch https://github.com/google/kmsan.git master OK
2021/04/09 23:12 22m phil@philpotter.co.uk patch https://github.com/google/kmsan.git master OK
2021/04/09 10:58 39m phil@philpotter.co.uk https://github.com/google/kmsan.git master report log

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in ip_rcv_core+0xf4c/0x1480 net/ipv4/ip_input.c:477
CPU: 0 PID: 8439 Comm: syz-executor522 Not tainted 5.12.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x24c/0x2e0 lib/dump_stack.c:120
 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:121
 __msan_warning+0x5c/0xa0 mm/kmsan/kmsan_instr.c:197
 ip_rcv_core+0xf4c/0x1480 net/ipv4/ip_input.c:477
 ip_rcv+0xc7/0x820 net/ipv4/ip_input.c:536
 __netif_receive_skb_one_core net/core/dev.c:5384 [inline]
 __netif_receive_skb+0x1ec/0x640 net/core/dev.c:5498
 process_backlog+0x517/0xbd0 net/core/dev.c:6365
 __napi_poll+0x13e/0xca0 net/core/dev.c:6912
 napi_poll net/core/dev.c:6979 [inline]
 net_rx_action+0x726/0x14a0 net/core/dev.c:7065
 __do_softirq+0x1b9/0x715 kernel/softirq.c:345
 do_softirq+0x123/0x1c0 kernel/softirq.c:248
 </IRQ>
 __local_bh_enable_ip+0xa1/0xb0 kernel/softirq.c:198
 local_bh_enable+0x36/0x40 include/linux/bottom_half.h:32
 rcu_read_unlock_bh include/linux/rcupdate.h:745 [inline]
 __dev_queue_xmit+0x3b4a/0x4600 net/core/dev.c:4221
 dev_queue_xmit+0x4b/0x60 net/core/dev.c:4227
 packet_snd net/packet/af_packet.c:3006 [inline]
 packet_sendmsg+0x86ee/0x99d0 net/packet/af_packet.c:3031
 sock_sendmsg_nosec net/socket.c:654 [inline]
 sock_sendmsg net/socket.c:674 [inline]
 ____sys_sendmsg+0xcfc/0x12f0 net/socket.c:2350
 ___sys_sendmsg net/socket.c:2404 [inline]
 __sys_sendmsg+0x714/0x830 net/socket.c:2433
 __do_sys_sendmsg net/socket.c:2442 [inline]
 __se_sys_sendmsg+0x97/0xb0 net/socket.c:2440
 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2440
 do_syscall_64+0x9f/0x140 arch/x86/entry/common.c:48
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x443e09
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdd4b96a28 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000443e09
RDX: 0000000000000000 RSI: 0000000020000680 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000f0b5ff R09: 0000000000f0b5ff
R10: 00007ffdd4b964a0 R11: 0000000000000246 R12: 00007ffdd4b96a60
R13: 00007ffdd4b96a50 R14: 00007ffdd4b96a40 R15: 0000000000000003

Uninit was stored to memory at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:120 [inline]
 kmsan_internal_chain_origin+0xad/0x130 mm/kmsan/kmsan.c:288
 __msan_chain_origin+0x54/0xa0 mm/kmsan/kmsan_instr.c:147
 iptunnel_xmit+0xbd6/0xf20 net/ipv4/ip_tunnel_core.c:76
 udp_tunnel_xmit_skb+0x526/0x640 net/ipv4/udp_tunnel_core.c:174
 geneve_xmit_skb drivers/net/geneve.c:959 [inline]
 geneve_xmit+0x2139/0x3c40 drivers/net/geneve.c:1059
 __netdev_start_xmit include/linux/netdevice.h:4825 [inline]
 netdev_start_xmit include/linux/netdevice.h:4839 [inline]
 xmit_one+0x2b6/0x760 net/core/dev.c:3605
 dev_hard_start_xmit net/core/dev.c:3621 [inline]
 __dev_queue_xmit+0x3432/0x4600 net/core/dev.c:4194
 dev_queue_xmit+0x4b/0x60 net/core/dev.c:4227
 packet_snd net/packet/af_packet.c:3006 [inline]
 packet_sendmsg+0x86ee/0x99d0 net/packet/af_packet.c:3031
 sock_sendmsg_nosec net/socket.c:654 [inline]
 sock_sendmsg net/socket.c:674 [inline]
 ____sys_sendmsg+0xcfc/0x12f0 net/socket.c:2350
 ___sys_sendmsg net/socket.c:2404 [inline]
 __sys_sendmsg+0x714/0x830 net/socket.c:2433
 __do_sys_sendmsg net/socket.c:2442 [inline]
 __se_sys_sendmsg+0x97/0xb0 net/socket.c:2440
 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2440
 do_syscall_64+0x9f/0x140 arch/x86/entry/common.c:48
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:120 [inline]
 kmsan_internal_poison_shadow+0x66/0xd0 mm/kmsan/kmsan.c:103
 kmsan_slab_alloc+0x8e/0xe0 mm/kmsan/kmsan_hooks.c:76
 slab_alloc_node mm/slub.c:2922 [inline]
 __kmalloc_node_track_caller+0xa4f/0x1470 mm/slub.c:4609
 kmalloc_reserve net/core/skbuff.c:353 [inline]
 __alloc_skb+0x4dd/0xe90 net/core/skbuff.c:424
 alloc_skb include/linux/skbuff.h:1103 [inline]
 alloc_skb_with_frags+0x1f3/0xc10 net/core/skbuff.c:5948
 sock_alloc_send_pskb+0xdc1/0xf90 net/core/sock.c:2362
 packet_alloc_skb net/packet/af_packet.c:2854 [inline]
 packet_snd net/packet/af_packet.c:2949 [inline]
 packet_sendmsg+0x6a12/0x99d0 net/packet/af_packet.c:3031
 sock_sendmsg_nosec net/socket.c:654 [inline]
 sock_sendmsg net/socket.c:674 [inline]
 ____sys_sendmsg+0xcfc/0x12f0 net/socket.c:2350
 ___sys_sendmsg net/socket.c:2404 [inline]
 __sys_sendmsg+0x714/0x830 net/socket.c:2433
 __do_sys_sendmsg net/socket.c:2442 [inline]
 __se_sys_sendmsg+0x97/0xb0 net/socket.c:2440
 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2440
 do_syscall_64+0x9f/0x140 arch/x86/entry/common.c:48
 entry_SYSCALL_64_after_hwframe+0x44/0xae
=====================================================

Crashes (141):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kmsan-gce 2021/07/16 10:57 https://github.com/google/kmsan.git master 57b5797c8013 f115ae98 .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/07/15 09:18 https://github.com/google/kmsan.git master 57b5797c8013 b9a2f64e .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/07/15 01:44 https://github.com/google/kmsan.git master 57b5797c8013 94e0b707 .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/07/11 05:11 https://github.com/google/kmsan.git master 57b5797c8013 8f5a7b8c .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/07/11 04:20 https://github.com/google/kmsan.git master 57b5797c8013 8f5a7b8c .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/07/03 21:31 https://github.com/google/kmsan.git master 57b5797c8013 55aa55c2 .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/06/26 12:50 https://github.com/google/kmsan.git master 57b5797c8013 9d2ab5df .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/06/18 10:23 https://github.com/google/kmsan.git master bfeba8b4c158 aba2b2fb .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/06/17 19:31 https://github.com/google/kmsan.git master 89a0faf20faa aba2b2fb .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/06/17 17:27 https://github.com/google/kmsan.git master 89a0faf20faa aba2b2fb .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/06/15 21:00 https://github.com/google/kmsan.git master 7bcc9a7be76b 58636922 .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/06/10 18:34 https://github.com/google/kmsan.git master 6099c9da2f7d 1ba81399 .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/06/05 09:23 https://github.com/google/kmsan.git master 6099c9da2f7d 500c2339 .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/05/29 15:09 https://github.com/google/kmsan.git master 6099c9da2f7d 858ea628 .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/05/25 15:49 https://github.com/google/kmsan.git master 6099c9da2f7d 3c7fef33 .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/05/23 18:18 https://github.com/google/kmsan.git master 6099c9da2f7d 3c7fef33 .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/05/23 04:17 https://github.com/google/kmsan.git master 6099c9da2f7d 3c7fef33 .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/05/23 03:30 https://github.com/google/kmsan.git master 6099c9da2f7d 3c7fef33 .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/05/22 21:42 https://github.com/google/kmsan.git master 6099c9da2f7d 3c7fef33 .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/05/20 18:21 https://github.com/google/kmsan.git master 6099c9da2f7d c560a65d .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/05/20 16:35 https://github.com/google/kmsan.git master 6099c9da2f7d c560a65d .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/05/10 19:56 https://github.com/google/kmsan.git master 4ebaab5fb428 ca873091 .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/05/07 14:54 https://github.com/google/kmsan.git master 4ebaab5fb428 f6da8120 .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/05/02 07:34 https://github.com/google/kmsan.git master 4ebaab5fb428 77e2b668 .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/04/30 19:09 https://github.com/google/kmsan.git master 4ebaab5fb428 77e2b668 .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/04/13 05:17 https://github.com/google/kmsan.git master 4ebaab5fb428 bfeda1b1 .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/04/02 10:47 https://github.com/google/kmsan.git master 29ad81a1074a 6a81331a .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/03/24 22:51 https://github.com/google/kmsan.git master 29ad81a1074a 607e3baf .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/03/16 08:50 https://github.com/google/kmsan.git master 29ad81a1074a fdb2bb2c .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/03/12 21:21 https://github.com/google/kmsan.git master 29ad81a1074a 429d8a6b .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/02/28 10:56 https://github.com/google/kmsan.git master 29ad81a1074a 4c37c133 .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/02/27 11:19 https://github.com/google/kmsan.git master 29ad81a1074a 4c37c133 .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/02/27 10:29 https://github.com/google/kmsan.git master 29ad81a1074a 4c37c133 .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/02/17 01:40 https://github.com/google/kmsan.git master 29ad81a1074a 98682e5e .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/02/16 14:09 https://github.com/google/kmsan.git master 29ad81a1074a 98682e5e .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/02/14 15:58 https://github.com/google/kmsan.git master 29ad81a1074a 98682e5e .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/02/07 00:30 https://github.com/google/kmsan.git master 73d62e81b476 0655e081 .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/02/01 05:38 https://github.com/google/kmsan.git master 73d62e81b476 fc9fd31e .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/01/29 17:49 https://github.com/google/kmsan.git master 73d62e81b476 6593fd32 .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/01/20 16:34 https://github.com/google/kmsan.git master 73d62e81b476 d4f4eca5 .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/01/18 19:16 https://github.com/google/kmsan.git master 73d62e81b476 63631df1 .config log report syz C KMSAN: uninit-value in ip_rcv_core
ci-upstream-kmsan-gce 2021/01/10 07:31 https://github.com/google/kmsan.git master 73d62e81b476 2c1f2513 .config log report syz C
ci-upstream-kmsan-gce 2021/01/09 20:55 https://github.com/google/kmsan.git master 73d62e81b476 2c1f2513 .config log report syz C
ci-upstream-kmsan-gce 2021/01/04 20:19 https://github.com/google/kmsan.git master 73d62e81b476 79264ae3 .config log report syz C
ci-upstream-kmsan-gce 2021/01/02 07:52 https://github.com/google/kmsan.git master 73d62e81b476 79264ae3 .config log report syz C
ci-upstream-kmsan-gce 2018/09/08 16:02 https://github.com/google/kmsan.git master 42a037ca8d9d 6b5120a4 .config log report syz C
ci-upstream-kmsan-gce-386 2020/07/23 14:29 https://github.com/google/kmsan.git master 93f54a72361a 340ea530 .config log report syz C
ci-upstream-kmsan-gce 2019/11/23 22:01 https://github.com/google/kmsan.git master 4a1d41e39c62 598ca6c8 .config log report
ci-upstream-kmsan-gce 2019/06/17 15:03 https://github.com/google/kmsan.git master aad0f0dd72ab 442206d7 .config log report
ci-upstream-kmsan-gce 2018/11/20 01:50 https://github.com/google/kmsan.git master 2808e543aacb adf636a8 .config log report
ci-upstream-kmsan-gce 2018/09/27 20:11 https://github.com/google/kmsan.git master a5bff9bd1b2a 0c2fa87b .config log report
ci-upstream-kmsan-gce 2018/09/27 20:11 https://github.com/google/kmsan.git master a5bff9bd1b2a 0c2fa87b .config log report
ci-upstream-kmsan-gce 2018/09/27 20:03 https://github.com/google/kmsan.git master a5bff9bd1b2a 0c2fa87b .config log report
ci-upstream-kmsan-gce 2018/09/12 21:33 https://github.com/google/kmsan.git master c795108d2d1c 71907daf .config log report
ci-upstream-kmsan-gce 2018/09/10 09:50 https://github.com/google/kmsan.git master 915c18a6ce9b 6b5120a4 .config log report
ci-upstream-kmsan-gce 2018/09/10 05:35 https://github.com/google/kmsan.git master 42a037ca8d9d 6b5120a4 .config log report
ci-upstream-kmsan-gce 2018/09/10 02:05 https://github.com/google/kmsan.git master 42a037ca8d9d 6b5120a4 .config log report
ci-upstream-kmsan-gce 2018/09/10 01:35 https://github.com/google/kmsan.git master 42a037ca8d9d 6b5120a4 .config log report
ci-upstream-kmsan-gce 2018/09/10 00:18 https://github.com/google/kmsan.git master 42a037ca8d9d 6b5120a4 .config log report
ci-upstream-kmsan-gce 2018/09/10 00:02 https://github.com/google/kmsan.git master 42a037ca8d9d 6b5120a4 .config log report
ci-upstream-kmsan-gce 2018/09/09 21:57 https://github.com/google/kmsan.git master 42a037ca8d9d 6b5120a4 .config log report
ci-upstream-kmsan-gce 2018/09/09 20:04 https://github.com/google/kmsan.git master 42a037ca8d9d 6b5120a4 .config log report
ci-upstream-kmsan-gce 2018/09/09 18:56 https://github.com/google/kmsan.git master 42a037ca8d9d 6b5120a4 .config log report
ci-upstream-kmsan-gce 2018/09/09 16:52 https://github.com/google/kmsan.git master 42a037ca8d9d 6b5120a4 .config log report
ci-upstream-kmsan-gce 2018/09/09 16:19 https://github.com/google/kmsan.git master 42a037ca8d9d 6b5120a4 .config log report
ci-upstream-kmsan-gce 2018/09/09 14:45 https://github.com/google/kmsan.git master 42a037ca8d9d 6b5120a4 .config log report
ci-upstream-kmsan-gce 2018/09/09 11:21 https://github.com/google/kmsan.git master 42a037ca8d9d 6b5120a4 .config log report
ci-upstream-kmsan-gce 2018/09/09 11:20 https://github.com/google/kmsan.git master 42a037ca8d9d 6b5120a4 .config log report
ci-upstream-kmsan-gce 2018/09/09 10:45 https://github.com/google/kmsan.git master 42a037ca8d9d 6b5120a4 .config log report
ci-upstream-kmsan-gce 2018/09/09 06:18 https://github.com/google/kmsan.git master 42a037ca8d9d 6b5120a4 .config log report
ci-upstream-kmsan-gce 2018/09/09 05:31 https://github.com/google/kmsan.git master 42a037ca8d9d 6b5120a4 .config log report
ci-upstream-kmsan-gce 2018/09/09 04:54 https://github.com/google/kmsan.git master 42a037ca8d9d 6b5120a4 .config log report
ci-upstream-kmsan-gce 2018/09/09 01:30 https://github.com/google/kmsan.git master 42a037ca8d9d 6b5120a4 .config log report
ci-upstream-kmsan-gce 2018/09/08 23:59 https://github.com/google/kmsan.git master 42a037ca8d9d 6b5120a4 .config log report
ci-upstream-kmsan-gce 2018/09/08 23:58 https://github.com/google/kmsan.git master 42a037ca8d9d 6b5120a4 .config log report
ci-upstream-kmsan-gce 2018/09/08 23:08 https://github.com/google/kmsan.git master 42a037ca8d9d 6b5120a4 .config log report
ci-upstream-kmsan-gce 2018/09/08 20:29 https://github.com/google/kmsan.git master 42a037ca8d9d 6b5120a4 .config log report
ci-upstream-kmsan-gce 2018/09/08 20:06 https://github.com/google/kmsan.git master 42a037ca8d9d 6b5120a4 .config log report
ci-upstream-kmsan-gce 2018/09/08 19:19 https://github.com/google/kmsan.git master 42a037ca8d9d 6b5120a4 .config log report
ci-upstream-kmsan-gce 2018/09/08 19:09 https://github.com/google/kmsan.git master 42a037ca8d9d 6b5120a4 .config log report
ci-upstream-kmsan-gce 2018/09/08 18:34 https://github.com/google/kmsan.git master 42a037ca8d9d 6b5120a4 .config log report
ci-upstream-kmsan-gce 2018/09/08 18:17 https://github.com/google/kmsan.git master 42a037ca8d9d 6b5120a4 .config log report