syzbot


KMSAN: uninit-value in rt6_score_route (2)

Status: closed as invalid on 2021/12/06 16:49
Subsystems: net
[Documentation on labels]
First crash: 878d, last: 878d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in exit_to_user_mode_loop (3) kernel C 2558 681d 940d 0/26 auto-closed as invalid on 2022/09/22 19:06

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in rt6_score_route+0x178/0xc80 net/ipv6/route.c:711
 rt6_score_route+0x178/0xc80 net/ipv6/route.c:711
 find_match+0x391/0x1730 net/ipv6/route.c:743
 __find_rr_leaf+0x4bd/0x10e0 net/ipv6/route.c:826
 find_rr_leaf net/ipv6/route.c:847 [inline]
 rt6_select net/ipv6/route.c:891 [inline]
 fib6_table_lookup+0x651/0x1530 net/ipv6/route.c:2185
 ip6_pol_route+0x283/0x2ce0 net/ipv6/route.c:2221
 ip6_pol_route_input+0x123/0x140 net/ipv6/route.c:2279
 pol_lookup_func include/net/ip6_fib.h:579 [inline]
 fib6_rule_lookup+0x612/0xb00 net/ipv6/fib6_rules.c:120
 ip6_route_input_lookup+0x21b/0x240 net/ipv6/route.c:2291
 seg6_lookup_any_nexthop+0x64c/0xd80 net/ipv6/seg6_local.c:260
 seg6_lookup_nexthop net/ipv6/seg6_local.c:298 [inline]
 input_action_end+0x1cf/0x320 net/ipv6/seg6_local.c:312
 seg6_local_input_core net/ipv6/seg6_local.c:1126 [inline]
 seg6_local_input+0x1cb/0xa40 net/ipv6/seg6_local.c:1148
 lwtunnel_input+0x244/0x360 net/core/lwtunnel.c:407
 dst_input include/net/dst.h:460 [inline]
 ip6_rcv_finish+0x5fa/0x7f0 net/ipv6/ip6_input.c:76
 NF_HOOK include/linux/netfilter.h:307 [inline]
 ipv6_rcv+0x1d1/0x450 net/ipv6/ip6_input.c:297
 __netif_receive_skb_one_core net/core/dev.c:5443 [inline]
 __netif_receive_skb+0x1ec/0x630 net/core/dev.c:5557
 netif_receive_skb_internal+0x1ae/0x3d0 net/core/dev.c:5643
 netif_receive_skb+0x49/0x270 net/core/dev.c:5702
 tun_rx_batched+0xaa7/0xd30
 tun_get_user+0x5455/0x5a60 drivers/net/tun.c:1907
 tun_chr_write_iter+0x411/0x590 drivers/net/tun.c:1937
 call_write_iter include/linux/fs.h:2163 [inline]
 new_sync_write fs/read_write.c:507 [inline]
 vfs_write+0x1295/0x1f20 fs/read_write.c:594
 ksys_write+0x28c/0x520 fs/read_write.c:647
 __do_sys_write fs/read_write.c:659 [inline]
 __se_sys_write fs/read_write.c:656 [inline]
 __x64_sys_write+0xdb/0x120 fs/read_write.c:656
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Local variable fl6 created at:
 seg6_lookup_any_nexthop+0x18c/0xd80 net/ipv6/seg6_local.c:246
 seg6_lookup_nexthop net/ipv6/seg6_local.c:298 [inline]
 input_action_end+0x1cf/0x320 net/ipv6/seg6_local.c:312
=====================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/11/29 18:56 https://github.com/google/kmsan.git master a535b0caaa2f d0830353 .config console log report info ci-upstream-kmsan-gce KMSAN: uninit-value in rt6_score_route
* Struck through repros no longer work on HEAD.