syzbot

 sign-in | mailing list | source | docs
🐞 Open [985] ≡ Subsystems 🐞 Fixed [5216] 🐞 Invalid [12474] ⬇ Missing Backports [82] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

KMSAN: uninit-value in expire_timers

Status: auto-closed as invalid on 2020/10/11 00:10
Subsystems: kernel
[Documentation on labels]
First crash: 1350d, last: 1346d
▶ ▼ Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in expire_timers (2) kernel 2 1118d 1155d 0/26 auto-closed as invalid on 2021/06/26 09:57
upstream KMSAN: uninit-value in expire_timers (3) ext4 1 1020d 1020d 0/26 auto-closed as invalid on 2021/10/02 12:28
upstream KMSAN: uninit-value in expire_timers (4) kernel 1 891d 891d 0/26 auto-closed as invalid on 2022/02/08 07:20

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in __hlist_del include/linux/list.h:812 [inline]
BUG: KMSAN: uninit-value in detach_timer kernel/time/timer.c:814 [inline]
BUG: KMSAN: uninit-value in expire_timers+0x38d/0x780 kernel/time/timer.c:1438
CPU: 0 PID: 9101 Comm: syz-executor.0 Not tainted 5.8.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x21c/0x280 lib/dump_stack.c:118
 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:121
 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215
 __hlist_del include/linux/list.h:812 [inline]
 detach_timer kernel/time/timer.c:814 [inline]
 expire_timers+0x38d/0x780 kernel/time/timer.c:1438
 __run_timers+0xaf4/0xd30 kernel/time/timer.c:1773
 run_timer_softirq+0x2d/0x50 kernel/time/timer.c:1786
 __do_softirq+0x2ea/0x7f5 kernel/softirq.c:293
 asm_call_on_stack+0xf/0x20 arch/x86/entry/entry_64.S:711
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:23 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:50 [inline]
 do_softirq_own_stack+0x7c/0xa0 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:390 [inline]
 __irq_exit_rcu+0x226/0x270 kernel/softirq.c:420
 irq_exit_rcu+0xe/0x10 kernel/softirq.c:432
 sysvec_apic_timer_interrupt+0x107/0x130 arch/x86/kernel/apic/apic.c:1091
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:593
RIP: 0010:fproduct_copy_from_wide_ lib/crypto/curve25519-hacl64.c:69 [inline]
RIP: 0010:fsquare_fsquare_ lib/crypto/curve25519-hacl64.c:265 [inline]
RIP: 0010:fsquare_fsquare_times_ lib/crypto/curve25519-hacl64.c:278 [inline]
RIP: 0010:fsquare_fsquare_times lib/crypto/curve25519-hacl64.c:288 [inline]
RIP: 0010:addanddouble_fmonty lib/crypto/curve25519-hacl64.c:525 [inline]
RIP: 0010:ladder_smallloop_cmult_small_loop_step lib/crypto/curve25519-hacl64.c:552 [inline]
RIP: 0010:ladder_smallloop_cmult_small_loop_double_step lib/crypto/curve25519-hacl64.c:564 [inline]
RIP: 0010:ladder_smallloop_cmult_small_loop lib/crypto/curve25519-hacl64.c:572 [inline]
RIP: 0010:ladder_bigloop_cmult_big_loop lib/crypto/curve25519-hacl64.c:585 [inline]
RIP: 0010:ladder_cmult lib/crypto/curve25519-hacl64.c:599 [inline]
RIP: 0010:curve25519_generic+0xd112/0x24290 lib/crypto/curve25519-hacl64.c:781
Code: 48 89 44 24 20 4d 8d 6c 5d 00 48 8b 5c 24 48 4c 21 fb 4c 89 b4 24 38 06 00 00 4c 8b b4 24 a8 00 00 00 4d 21 fe 4c 21 7c 24 30 <48> 8d bc 24 40 06 00 00 e8 91 d1 7d fc 4c 0b b4 24 88 00 00 00 4c
RSP: 0018:ffff88808114af00 EFLAGS: 00000202
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000080d4b538
RDX: ffff888080d4b538 RSI: 0000000000000200 RDI: ffff88808114b538
RBP: ffff88808114b670 R08: ffffea000000000f R09: ffff88812fffa000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0238d04ca12f800d R14: 0000000000000000 R15: 0007ffffffffffff
 curve25519_generate_public include/crypto/curve25519.h:55 [inline]
 wg_set_device+0x11f6/0x4110 drivers/net/wireguard/netlink.c:558
 genl_family_rcv_msg_doit net/netlink/genetlink.c:669 [inline]
 genl_family_rcv_msg net/netlink/genetlink.c:714 [inline]
 genl_rcv_msg+0x1703/0x18a0 net/netlink/genetlink.c:731
 netlink_rcv_skb+0x6d7/0x7e0 net/netlink/af_netlink.c:2469
 genl_rcv+0x63/0x80 net/netlink/genetlink.c:742
 netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline]
 netlink_unicast+0x11c8/0x1490 net/netlink/af_netlink.c:1329
 netlink_sendmsg+0x173a/0x1840 net/netlink/af_netlink.c:1918
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg net/socket.c:672 [inline]
 __sys_sendto+0x9f8/0xca0 net/socket.c:1995
 __do_sys_sendto net/socket.c:2007 [inline]
 __se_sys_sendto+0x107/0x130 net/socket.c:2003
 __x64_sys_sendto+0x6e/0x90 net/socket.c:2003
 do_syscall_64+0xad/0x160 arch/x86/entry/common.c:386
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x416ae3
Code: Bad RIP value.
RSP: 002b:000000000169f7d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00000000016a3700 RCX: 0000000000416ae3
RDX: 0000000000000170 RSI: 00000000016a3750 RDI: 0000000000000004
RBP: 0000000000000000 R08: 000000000169f7e0 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00000000016a3750 R15: 0000000000000004

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:144 [inline]
 kmsan_internal_poison_shadow+0x66/0xd0 mm/kmsan/kmsan.c:127
 kmsan_slab_alloc+0x8a/0xe0 mm/kmsan/kmsan_hooks.c:80
 slab_alloc_node mm/slub.c:2839 [inline]
 slab_alloc mm/slub.c:2848 [inline]
 __kmalloc_track_caller+0xbe8/0xe10 mm/slub.c:4447
 kmemdup+0x95/0x140 mm/util.c:127
 __addrconf_sysctl_register+0xe1/0x7f0 net/ipv6/addrconf.c:6882
 addrconf_sysctl_register+0x31d/0x3e0 net/ipv6/addrconf.c:6947
 ipv6_add_dev+0x1403/0x1c50 net/ipv6/addrconf.c:443
 addrconf_notify+0xcc7/0x6400 net/ipv6/addrconf.c:3462
 notifier_call_chain kernel/notifier.c:83 [inline]
 __raw_notifier_call_chain kernel/notifier.c:361 [inline]
 raw_notifier_call_chain+0x123/0x290 kernel/notifier.c:368
 call_netdevice_notifiers_info net/core/dev.c:2027 [inline]
 call_netdevice_notifiers_extack net/core/dev.c:2039 [inline]
 call_netdevice_notifiers net/core/dev.c:2053 [inline]
 register_netdevice+0x3120/0x37d0 net/core/dev.c:9545
 veth_newlink+0xb5c/0x15c0 drivers/net/veth.c:1366
 __rtnl_newlink net/core/rtnetlink.c:3339 [inline]
 rtnl_newlink+0x2e03/0x3ed0 net/core/rtnetlink.c:3397
 rtnetlink_rcv_msg+0x142b/0x18c0 net/core/rtnetlink.c:5460
 netlink_rcv_skb+0x6d7/0x7e0 net/netlink/af_netlink.c:2469
 rtnetlink_rcv+0x50/0x60 net/core/rtnetlink.c:5478
 netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline]
 netlink_unicast+0x11c8/0x1490 net/netlink/af_netlink.c:1329
 netlink_sendmsg+0x173a/0x1840 net/netlink/af_netlink.c:1918
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg net/socket.c:672 [inline]
 __sys_sendto+0x9f8/0xca0 net/socket.c:1995
 __do_sys_sendto net/socket.c:2007 [inline]
 __se_sys_sendto+0x107/0x130 net/socket.c:2003
 __x64_sys_sendto+0x6e/0x90 net/socket.c:2003
 do_syscall_64+0xad/0x160 arch/x86/entry/common.c:386
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
=====================================================

Crashes (15):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/08/12 00:07 https://github.com/google/kmsan.git master ce8056d1f79e bacaf5fa .config console log report ci-upstream-kmsan-gce
2020/08/11 11:43 https://github.com/google/kmsan.git master ce8056d1f79e bacaf5fa .config console log report ci-upstream-kmsan-gce
2020/08/11 09:44 https://github.com/google/kmsan.git master ce8056d1f79e bacaf5fa .config console log report ci-upstream-kmsan-gce
2020/08/11 04:35 https://github.com/google/kmsan.git master ce8056d1f79e 7adc7b65 .config console log report ci-upstream-kmsan-gce
2020/08/11 03:36 https://github.com/google/kmsan.git master ce8056d1f79e 7adc7b65 .config console log report ci-upstream-kmsan-gce
2020/08/11 03:24 https://github.com/google/kmsan.git master ce8056d1f79e 7adc7b65 .config console log report ci-upstream-kmsan-gce
2020/08/10 22:29 https://github.com/google/kmsan.git master ce8056d1f79e 7adc7b65 .config console log report ci-upstream-kmsan-gce
2020/08/10 09:36 https://github.com/google/kmsan.git master ce8056d1f79e 70301872 .config console log report ci-upstream-kmsan-gce
2020/08/10 08:34 https://github.com/google/kmsan.git master ce8056d1f79e 70301872 .config console log report ci-upstream-kmsan-gce
2020/08/10 01:14 https://github.com/google/kmsan.git master ce8056d1f79e 70301872 .config console log report ci-upstream-kmsan-gce
2020/08/09 13:30 https://github.com/google/kmsan.git master ce8056d1f79e f721e4a0 .config console log report ci-upstream-kmsan-gce
2020/08/09 00:40 https://github.com/google/kmsan.git master ce8056d1f79e f721e4a0 .config console log report ci-upstream-kmsan-gce
2020/08/08 09:02 https://github.com/google/kmsan.git master ce8056d1f79e ff51e522 .config console log report ci-upstream-kmsan-gce
2020/08/08 08:13 https://github.com/google/kmsan.git master ce8056d1f79e ff51e522 .config console log report ci-upstream-kmsan-gce
2020/08/07 23:57 https://github.com/google/kmsan.git master 05fd5f9f0208 cb436c69 .config console log report ci-upstream-kmsan-gce
* Struck through repros no longer work on HEAD.