syzbot


KMSAN: uninit-value in __tipc_nl_bearer_enable

Status: upstream: reported C repro on 2018/12/18 13:01
Reported-by: syzbot+e820fdc8ce362f2dea51@syzkaller.appspotmail.com
Fix commit: 7f36f798f89b tipc: check attribute length for bearer name
Patched on: [ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-leak ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce ci-upstream-kmsan-gce-386 ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu2-riscv64]
First crash: 1297d, last: 13h30m
similar bugs (2):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in fib_get_nhs C 14 138d 208d 22/22 fixed on 2022/03/08 16:11
upstream KMSAN: uninit-value in strstr C 63 9d22h 711d 0/22 upstream: reported C repro on 2020/07/25 18:13

Sample crash report:
netlink: 20 bytes leftover after parsing attributes in process `syz-executor377'.
=====================================================
BUG: KMSAN: uninit-value in string_nocheck lib/vsprintf.c:644 [inline]
BUG: KMSAN: uninit-value in string+0x4f9/0x6f0 lib/vsprintf.c:725
 string_nocheck lib/vsprintf.c:644 [inline]
 string+0x4f9/0x6f0 lib/vsprintf.c:725
 vsnprintf+0x2222/0x3650 lib/vsprintf.c:2806
 vprintk_store+0x537/0x2150 kernel/printk/printk.c:2158
 vprintk_emit+0x28b/0xab0 kernel/printk/printk.c:2256
 vprintk_default+0x86/0xa0 kernel/printk/printk.c:2283
 vprintk+0x15f/0x180 kernel/printk/printk_safe.c:50
 _printk+0x18d/0x1cf kernel/printk/printk.c:2293
 tipc_enable_bearer net/tipc/bearer.c:371 [inline]
 __tipc_nl_bearer_enable+0x2022/0x22a0 net/tipc/bearer.c:1033
 tipc_nl_bearer_enable+0x6c/0xb0 net/tipc/bearer.c:1042
 genl_family_rcv_msg_doit net/netlink/genetlink.c:731 [inline]
 genl_family_rcv_msg net/netlink/genetlink.c:775 [inline]
 genl_rcv_msg+0x157f/0x1660 net/netlink/genetlink.c:792
 netlink_rcv_skb+0x40c/0x7e0 net/netlink/af_netlink.c:2503
 genl_rcv+0x63/0x80 net/netlink/genetlink.c:803
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x109c/0x1370 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x14dc/0x1720 net/netlink/af_netlink.c:1921
 sock_sendmsg_nosec net/socket.c:705 [inline]
 sock_sendmsg net/socket.c:725 [inline]
 ____sys_sendmsg+0xe11/0x12c0 net/socket.c:2413
 ___sys_sendmsg net/socket.c:2467 [inline]
 __sys_sendmsg+0x704/0x840 net/socket.c:2496
 __do_sys_sendmsg net/socket.c:2505 [inline]
 __se_sys_sendmsg net/socket.c:2503 [inline]
 __x64_sys_sendmsg+0xe2/0x120 net/socket.c:2503
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x51/0xa0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Uninit was created at:
 slab_post_alloc_hook mm/slab.h:754 [inline]
 slab_alloc_node mm/slub.c:3231 [inline]
 __kmalloc_node_track_caller+0xde3/0x14f0 mm/slub.c:4962
 kmalloc_reserve net/core/skbuff.c:354 [inline]
 __alloc_skb+0x545/0xf90 net/core/skbuff.c:426
 alloc_skb include/linux/skbuff.h:1300 [inline]
 netlink_alloc_large_skb net/netlink/af_netlink.c:1191 [inline]
 netlink_sendmsg+0xde3/0x1720 net/netlink/af_netlink.c:1896
 sock_sendmsg_nosec net/socket.c:705 [inline]
 sock_sendmsg net/socket.c:725 [inline]
 ____sys_sendmsg+0xe11/0x12c0 net/socket.c:2413
 ___sys_sendmsg net/socket.c:2467 [inline]
 __sys_sendmsg+0x704/0x840 net/socket.c:2496
 __do_sys_sendmsg net/socket.c:2505 [inline]
 __se_sys_sendmsg net/socket.c:2503 [inline]
 __x64_sys_sendmsg+0xe2/0x120 net/socket.c:2503
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x51/0xa0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x44/0xae

CPU: 0 PID: 3475 Comm: syz-executor377 Not tainted 5.18.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
=====================================================

Crashes (1121):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kmsan-gce 2022/05/14 06:23 https://github.com/google/kmsan.git master d6e2c8c7eb40 107f6434 .config log report syz C KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce 2019/03/27 01:46 https://github.com/google/kmsan.git master 3c26d882e695 55684ce1 .config log report syz
ci-upstream-kmsan-gce 2019/03/23 11:35 https://github.com/google/kmsan.git master c10a026b8dee 3361bde5 .config log report syz
ci-upstream-kmsan-gce 2019/03/21 01:12 https://github.com/google/kmsan.git master c10a026b8dee a664c187 .config log report syz
ci-upstream-kmsan-gce 2019/02/07 15:30 https://github.com/google/kmsan.git master fa1981bee40f aa4feb03 .config log report syz
ci-upstream-kmsan-gce 2019/02/02 18:09 https://github.com/google/kmsan.git master fa1981bee40f c198d5dd .config log report syz
ci-upstream-kmsan-gce 2019/01/06 08:01 https://github.com/google/kmsan.git master 11587f6ee534 53be0a37 .config log report syz
ci-upstream-kmsan-gce 2019/01/01 20:33 https://github.com/google/kmsan.git master 8ba10281f9e5 3d85f48c .config log report syz
ci-upstream-kmsan-gce 2019/01/01 13:00 https://github.com/google/kmsan.git master 8ba10281f9e5 3d85f48c .config log report syz
ci-upstream-kmsan-gce 2018/12/26 09:42 https://github.com/google/kmsan.git master 79fc24ff6184 8a41a0ad .config log report syz
ci-upstream-kmsan-gce 2018/12/18 09:44 https://github.com/google/kmsan.git master 0a602458c72c def91db3 .config log report syz
ci-upstream-kmsan-gce 2022/07/03 16:58 https://github.com/google/kmsan.git master 97117d69c353 1434eec0 .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce 2022/06/30 15:55 https://github.com/google/kmsan.git master ec1cbf8b060e 1434eec0 .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce 2022/06/26 13:30 https://github.com/google/kmsan.git master 4b28366af7d9 a371c43c .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce 2022/06/26 10:51 https://github.com/google/kmsan.git master 4b28366af7d9 a371c43c .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce 2022/06/26 03:46 https://github.com/google/kmsan.git master 4b28366af7d9 a371c43c .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce 2022/06/24 21:13 https://github.com/google/kmsan.git master 4b28366af7d9 a5dbd430 .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce 2022/06/21 06:33 https://github.com/google/kmsan.git master 7516e1b6d801 0fc5c330 .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce 2022/06/21 06:23 https://github.com/google/kmsan.git master 7516e1b6d801 0fc5c330 .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce 2022/06/15 19:39 https://github.com/google/kmsan.git master 2f3064574275 1719ee24 .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce 2022/05/25 08:45 https://github.com/google/kmsan.git master c5c93da9af13 647c0e27 .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce 2022/05/23 19:01 https://github.com/google/kmsan.git master c5c93da9af13 4c7657cb .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce 2022/05/21 22:31 https://github.com/google/kmsan.git master c5c93da9af13 7268fa62 .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce 2022/05/21 19:45 https://github.com/google/kmsan.git master c5c93da9af13 7268fa62 .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce 2022/05/19 20:32 https://github.com/google/kmsan.git master c5c93da9af13 50c53f39 .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce 2022/05/19 06:09 https://github.com/google/kmsan.git master c5c93da9af13 50c53f39 .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce 2022/05/18 22:13 https://github.com/google/kmsan.git master c5c93da9af13 50c53f39 .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce 2022/05/18 09:12 https://github.com/google/kmsan.git master a87d7972661b 744a39e2 .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce 2022/05/18 00:25 https://github.com/google/kmsan.git master bb5f91ee4783 744a39e2 .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce 2022/05/16 15:43 https://github.com/google/kmsan.git master d6e2c8c7eb40 744a39e2 .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce 2022/05/15 05:48 https://github.com/google/kmsan.git master d6e2c8c7eb40 744a39e2 .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce 2022/05/14 05:02 https://github.com/google/kmsan.git master d6e2c8c7eb40 107f6434 .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce 2022/05/10 09:32 https://github.com/google/kmsan.git master d6e2c8c7eb40 8b277b8e .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce 2022/04/29 12:31 https://github.com/google/kmsan.git master d6e2c8c7eb40 e9076525 .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce 2022/04/29 00:09 https://github.com/google/kmsan.git master d6e2c8c7eb40 e9076525 .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce 2022/04/28 10:39 https://github.com/google/kmsan.git master d6e2c8c7eb40 8a1f1f07 .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce 2022/04/28 08:52 https://github.com/google/kmsan.git master d6e2c8c7eb40 8a1f1f07 .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce 2022/04/25 16:36 https://github.com/google/kmsan.git master b834db009dc5 c889aef9 .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce 2022/04/25 04:42 https://github.com/google/kmsan.git master b834db009dc5 131df97d .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce 2022/04/24 19:49 https://github.com/google/kmsan.git master b834db009dc5 131df97d .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce 2022/04/24 12:05 https://github.com/google/kmsan.git master b834db009dc5 131df97d .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce 2022/04/24 06:06 https://github.com/google/kmsan.git master b834db009dc5 131df97d .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce 2022/04/24 00:28 https://github.com/google/kmsan.git master b834db009dc5 131df97d .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce 2022/04/23 03:36 https://github.com/google/kmsan.git master b834db009dc5 131df97d .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce 2022/04/22 10:59 https://github.com/google/kmsan.git master 33d9269ef6e0 2738b391 .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce-386 2022/07/04 07:07 https://github.com/google/kmsan.git master ec1cbf8b060e 1434eec0 .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce-386 2022/07/03 22:14 https://github.com/google/kmsan.git master ec1cbf8b060e 1434eec0 .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce-386 2022/07/01 15:07 https://github.com/google/kmsan.git master ec1cbf8b060e 1434eec0 .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce-386 2022/06/30 19:54 https://github.com/google/kmsan.git master ec1cbf8b060e 1434eec0 .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce-386 2022/06/23 08:55 https://github.com/google/kmsan.git master 4b28366af7d9 912f5df7 .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce-386 2022/06/23 06:02 https://github.com/google/kmsan.git master 4b28366af7d9 912f5df7 .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce-386 2022/06/21 10:56 https://github.com/google/kmsan.git master 7516e1b6d801 0fc5c330 .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce-386 2022/05/16 20:10 https://github.com/google/kmsan.git master d6e2c8c7eb40 744a39e2 .config log report info KMSAN: uninit-value in __tipc_nl_bearer_enable
ci-upstream-kmsan-gce 2022/05/14 15:58 https://github.com/google/kmsan.git master d6e2c8c7eb40 744a39e2 .config log report info KMSAN: uninit-value in vlan_dev_set_ingress_priority
ci-upstream-kmsan-gce 2022/04/19 19:50 https://github.com/google/kmsan.git master 33d9269ef6e0 c334415e .config log report info KMSAN: uninit-value in tipc_nl_node_set_link
ci-upstream-kmsan-gce 2022/03/28 21:36 https://github.com/google/kmsan.git master c44f7500ded9 ee339263 .config log report info KMSAN: uninit-value in tipc_nl_node_get_link
ci-upstream-kmsan-gce 2018/12/17 18:03 https://github.com/google/kmsan.git master 0a602458c72c def91db3 .config log report
ci-upstream-kmsan-gce-386 2022/07/06 05:21 https://github.com/google/kmsan.git master 97117d69c353 bff65f44 .config log report info KMSAN: uninit-value in tipc_nl_node_get_link
ci-upstream-kmsan-gce-386 2022/07/01 13:53 https://github.com/google/kmsan.git master ec1cbf8b060e 1434eec0 .config log report info KMSAN: uninit-value in bpf_sk_storage_diag_alloc
ci-upstream-kmsan-gce-386 2022/04/26 20:38 https://github.com/google/kmsan.git master e8cbf4e6e3e8 1fa34c1b .config log report info KMSAN: uninit-value in __fget_files
ci-upstream-kmsan-gce-386 2021/01/09 03:31 https://github.com/google/kmsan.git master 73d62e81b476 c104d4a3 .config log report info