syzbot


KMSAN: uninit-value in nf_hook_entries_grow

Status: auto-obsoleted due to no activity on 2024/03/16 13:56
Subsystems: netfilter
[Documentation on labels]
First crash: 195d, last: 143d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: use-after-free Read in nf_hook_entries_grow netfilter C done done 5 830d 870d 22/26 fixed on 2023/02/24 13:50

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in nf_hook_entries_grow+0x2fe/0xc40 net/netfilter/core.c:131
 nf_hook_entries_grow+0x2fe/0xc40 net/netfilter/core.c:131
 __nf_register_net_hook+0x3f5/0xc80 net/netfilter/core.c:435
 nf_register_net_hook+0x15b/0x310 net/netfilter/core.c:578
 nft_register_flowtable_net_hooks+0x633/0xca0 net/netfilter/nf_tables_api.c:8222
 nf_tables_newflowtable+0x2c7e/0x3ff0 net/netfilter/nf_tables_api.c:8430
 nfnetlink_rcv_batch net/netfilter/nfnetlink.c:519 [inline]
 nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:639 [inline]
 nfnetlink_rcv+0x1fc2/0x44a0 net/netfilter/nfnetlink.c:657
 netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline]
 netlink_unicast+0xf47/0x1250 net/netlink/af_netlink.c:1368
 netlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg net/socket.c:745 [inline]
 ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584
 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638
 __sys_sendmsg net/socket.c:2667 [inline]
 __do_sys_sendmsg net/socket.c:2676 [inline]
 __se_sys_sendmsg net/socket.c:2674 [inline]
 __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x63/0x6b

Uninit was created at:
 slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768
 slab_alloc_node mm/slub.c:3478 [inline]
 __kmem_cache_alloc_node+0x5c9/0x970 mm/slub.c:3517
 kmalloc_trace+0x51/0x200 mm/slab_common.c:1098
 kmalloc include/linux/slab.h:600 [inline]
 nft_netdev_hook_alloc net/netfilter/nf_tables_api.c:2082 [inline]
 nf_tables_parse_netdev_hooks+0x2a5/0xd70 net/netfilter/nf_tables_api.c:2136
 nft_flowtable_parse_hook+0x693/0xaa0 net/netfilter/nf_tables_api.c:8113
 nf_tables_newflowtable+0x1f88/0x3ff0 net/netfilter/nf_tables_api.c:8421
 nfnetlink_rcv_batch net/netfilter/nfnetlink.c:519 [inline]
 nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:639 [inline]
 nfnetlink_rcv+0x1fc2/0x44a0 net/netfilter/nfnetlink.c:657
 netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline]
 netlink_unicast+0xf47/0x1250 net/netlink/af_netlink.c:1368
 netlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg net/socket.c:745 [inline]
 ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584
 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638
 __sys_sendmsg net/socket.c:2667 [inline]
 __do_sys_sendmsg net/socket.c:2676 [inline]
 __se_sys_sendmsg net/socket.c:2674 [inline]
 __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x63/0x6b

CPU: 0 PID: 16559 Comm: syz-executor.2 Not tainted 6.7.0-rc5-syzkaller-00230-g3b8a9b2e6809 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
=====================================================

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/12/17 13:53 upstream 3b8a9b2e6809 3222d10c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce KMSAN: uninit-value in nf_hook_entries_grow
2023/11/28 17:38 upstream df60cee26a2e 1adfb6f6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce KMSAN: uninit-value in nf_hook_entries_grow
2023/11/07 23:14 upstream 13d88ac54ddd 83211397 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce KMSAN: uninit-value in nf_hook_entries_grow
2023/10/27 02:27 upstream 3a568e3a961b bf285f0c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce KMSAN: uninit-value in nf_hook_entries_grow
* Struck through repros no longer work on HEAD.