syzbot


KMSAN: uninit-value in ip_tunnel_xmit (4)

Status: auto-obsoleted due to no activity on 2024/01/12 09:25
Subsystems: net
[Documentation on labels]
First crash: 241d, last: 164d
Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in ip_tunnel_xmit (3) net C 1516 573d 1260d 0/26 closed as invalid on 2022/10/12 18:48
upstream KMSAN: uninit-value in ip_tunnel_xmit (2) net C 11778 1266d 2091d 15/26 fixed on 2020/11/16 12:12
upstream KMSAN: uninit-value in ip_tunnel_xmit net C 2594 2115d 2202d 8/26 fixed on 2018/07/17 16:09
linux-4.14 KASAN: use-after-free Read in ip_tunnel_xmit C inconclusive 5 543d 1156d 0/1 upstream: reported C repro on 2021/03/02 14:45
Last patch testing requests (3)
Created Duration User Patch Repo Result
2024/01/02 03:08 32m retest repro upstream OK log
2024/01/02 02:58 30m retest repro upstream OK log
2023/10/23 23:59 2h24m retest repro upstream report log

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in ip_tunnel_xmit+0x857/0x3e80 net/ipv4/ip_tunnel.c:679
 ip_tunnel_xmit+0x857/0x3e80 net/ipv4/ip_tunnel.c:679
 __gre_xmit net/ipv4/ip_gre.c:469 [inline]
 ipgre_xmit+0xd1c/0xe20 net/ipv4/ip_gre.c:662
 __netdev_start_xmit include/linux/netdevice.h:4889 [inline]
 netdev_start_xmit include/linux/netdevice.h:4903 [inline]
 xmit_one net/core/dev.c:3544 [inline]
 dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3560
 __dev_queue_xmit+0x34d0/0x52a0 net/core/dev.c:4340
 dev_queue_xmit include/linux/netdevice.h:3082 [inline]
 garp_queue_xmit net/802/garp.c:272 [inline]
 garp_join_timer+0x18e/0x2e0 net/802/garp.c:423
 call_timer_fn+0x45/0x4e0 kernel/time/timer.c:1700
 expire_timers kernel/time/timer.c:1751 [inline]
 __run_timers+0x850/0xf60 kernel/time/timer.c:2022
 run_timer_softirq+0x26/0x40 kernel/time/timer.c:2035
 __do_softirq+0x1b7/0x78f kernel/softirq.c:553
 invoke_softirq kernel/softirq.c:427 [inline]
 __irq_exit_rcu kernel/softirq.c:632 [inline]
 irq_exit_rcu+0x69/0x120 kernel/softirq.c:644
 sysvec_apic_timer_interrupt+0x7a/0x90 arch/x86/kernel/apic/apic.c:1074
 asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:645
 smap_restore arch/x86/include/asm/smap.h:56 [inline]
 get_shadow_origin_ptr mm/kmsan/instrumentation.c:37 [inline]
 __msan_metadata_ptr_for_load_4+0x2c/0x40 mm/kmsan/instrumentation.c:91
 stack_trace_consume_entry+0x16f/0x1e0 kernel/stacktrace.c:94
 arch_stack_walk+0x1bf/0x2c0 arch/x86/kernel/stacktrace.c:27
 stack_trace_save+0xa9/0xe0 kernel/stacktrace.c:122
 kmsan_save_stack_with_flags mm/kmsan/core.c:74 [inline]
 kmsan_internal_chain_origin+0x57/0xd0 mm/kmsan/core.c:248
 kmsan_internal_memmove_metadata+0x204/0x360 mm/kmsan/core.c:158
 __msan_memcpy+0x108/0x1b0 mm/kmsan/instrumentation.c:199
 pskb_expand_head+0x3b5/0x1a00 net/core/skbuff.c:2097
 netlink_trim+0x2c0/0x330 net/netlink/af_netlink.c:1324
 netlink_broadcast_filtered+0x82/0x2390 net/netlink/af_netlink.c:1531
 netlink_broadcast net/netlink/af_netlink.c:1576 [inline]
 nlmsg_multicast include/net/netlink.h:1079 [inline]
 nlmsg_notify+0x15f/0x2f0 net/netlink/af_netlink.c:2588
 rtnl_notify net/core/rtnetlink.c:771 [inline]
 rtmsg_ifinfo_send net/core/rtnetlink.c:4061 [inline]
 rtmsg_ifinfo_event net/core/rtnetlink.c:4077 [inline]
 rtmsg_ifinfo+0x1aa/0x230 net/core/rtnetlink.c:4083
 __dev_notify_flags+0x96/0x9f0 net/core/dev.c:8632
 __dev_set_promiscuity+0x308/0x9b0 net/core/dev.c:8406
 dev_set_promiscuity+0x69/0x180 net/core/dev.c:8426
 vlan_dev_change_rx_flags+0x24c/0x290 net/8021q/vlan_dev.c:497
 dev_change_rx_flags net/core/dev.c:8361 [inline]
 __dev_set_promiscuity+0x85e/0x9b0 net/core/dev.c:8403
 __dev_change_flags+0x6a7/0x930 net/core/dev.c:8606
 rtnl_configure_link net/core/rtnetlink.c:3296 [inline]
 rtnl_newlink_create net/core/rtnetlink.c:3493 [inline]
 __rtnl_newlink net/core/rtnetlink.c:3705 [inline]
 rtnl_newlink+0x30e4/0x4110 net/core/rtnetlink.c:3718
 rtnetlink_rcv_msg+0x16a6/0x1840 net/core/rtnetlink.c:6444
 netlink_rcv_skb+0x371/0x650 net/netlink/af_netlink.c:2545
 rtnetlink_rcv+0x34/0x40 net/core/rtnetlink.c:6462
 netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline]
 netlink_unicast+0xf47/0x1250 net/netlink/af_netlink.c:1368
 netlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910
 sock_sendmsg_nosec net/socket.c:730 [inline]
 sock_sendmsg net/socket.c:753 [inline]
 ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2540
 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2594
 __sys_sendmsg net/socket.c:2623 [inline]
 __do_sys_sendmsg net/socket.c:2632 [inline]
 __se_sys_sendmsg net/socket.c:2630 [inline]
 __x64_sys_sendmsg+0x307/0x490 net/socket.c:2630
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Uninit was created at:
 slab_post_alloc_hook+0x12f/0xb70 mm/slab.h:767
 slab_alloc_node mm/slub.c:3478 [inline]
 __kmem_cache_alloc_node+0x536/0x8d0 mm/slub.c:3517
 __do_kmalloc_node mm/slab_common.c:1022 [inline]
 __kmalloc_node_track_caller+0x118/0x3c0 mm/slab_common.c:1043
 kmalloc_reserve+0x248/0x470 net/core/skbuff.c:575
 __alloc_skb+0x318/0x740 net/core/skbuff.c:644
 alloc_skb include/linux/skbuff.h:1286 [inline]
 garp_pdu_init net/802/garp.c:225 [inline]
 garp_pdu_append_attr+0x299/0x1170 net/802/garp.c:296
 garp_attr_event+0x146/0x280 net/802/garp.c:338
 garp_gid_event net/802/garp.c:402 [inline]
 garp_join_timer+0xc5/0x2e0 net/802/garp.c:419
 call_timer_fn+0x45/0x4e0 kernel/time/timer.c:1700
 expire_timers kernel/time/timer.c:1751 [inline]
 __run_timers+0x850/0xf60 kernel/time/timer.c:2022
 run_timer_softirq+0x26/0x40 kernel/time/timer.c:2035
 __do_softirq+0x1b7/0x78f kernel/softirq.c:553

CPU: 0 PID: 5015 Comm: syz-executor289 Not tainted 6.5.0-syzkaller-11275-gdb906f0ca6bb #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
=====================================================

Crashes (21):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/09/04 06:48 upstream db906f0ca6bb 696ea0d2 .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce KMSAN: uninit-value in ip_tunnel_xmit
2023/11/12 22:53 upstream b57b17e88bf5 6d6dbf8a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce KMSAN: uninit-value in ip_tunnel_xmit
2023/11/12 21:35 upstream b57b17e88bf5 6d6dbf8a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce KMSAN: uninit-value in ip_tunnel_xmit
2023/11/01 09:25 upstream 89ed67ef126c 69904c9f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce KMSAN: uninit-value in ip_tunnel_xmit
2023/10/06 05:16 upstream f291209eca5e db17ad9f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce KMSAN: uninit-value in ip_tunnel_xmit
2023/10/05 22:59 upstream f291209eca5e db17ad9f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce KMSAN: uninit-value in ip_tunnel_xmit
2023/09/19 05:15 upstream 2cf0f7156238 0b6a67ac .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce KMSAN: uninit-value in ip_tunnel_xmit
2023/09/08 01:53 upstream 4a0fc73da97e 72324844 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce KMSAN: uninit-value in ip_tunnel_xmit
2023/09/04 04:45 upstream db906f0ca6bb 696ea0d2 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce KMSAN: uninit-value in ip_tunnel_xmit
2023/11/20 05:19 upstream eb3479bc23fa cb976f63 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386 KMSAN: uninit-value in ip_tunnel_xmit
2023/11/19 21:16 upstream 037266a5f723 cb976f63 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386 KMSAN: uninit-value in ip_tunnel_xmit
2023/11/12 17:33 upstream 1b907d050735 6d6dbf8a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386 KMSAN: uninit-value in ip_tunnel_xmit
2023/11/11 00:25 upstream ac347a0655db 45e9b83e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386 KMSAN: uninit-value in ip_tunnel_xmit
2023/11/10 00:46 upstream 4bbdb725a36b 56230772 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386 KMSAN: uninit-value in ip_tunnel_xmit
2023/11/09 15:20 upstream 6bc986ab839c 4862372a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386 KMSAN: uninit-value in ip_tunnel_xmit
2023/10/09 23:58 upstream 94f6f0550c62 3c53c7d9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386 KMSAN: uninit-value in ip_tunnel_xmit
2023/10/07 03:11 upstream af95dc6fdc25 ea12a918 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386 KMSAN: uninit-value in ip_tunnel_xmit
2023/10/06 05:19 upstream f291209eca5e db17ad9f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386 KMSAN: uninit-value in ip_tunnel_xmit
2023/10/03 17:20 upstream ce36c8b14987 65faba36 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386 KMSAN: uninit-value in ip_tunnel_xmit
2023/10/03 02:53 upstream 8f1b4600373f 50b20e75 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386 KMSAN: uninit-value in ip_tunnel_xmit
2023/09/23 05:43 upstream dc912ba91b7e 0b6a67ac .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386 KMSAN: uninit-value in ip_tunnel_xmit
* Struck through repros no longer work on HEAD.