syzbot


KMSAN: uninit-value in __netif_receive_skb_core (3)

Status: closed as invalid on 2024/12/17 17:57
Subsystems: bpf net
[Documentation on labels]
First crash: 73d, last: 65d
Similar bugs (5)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in __netif_receive_skb_core wireguard wireless C done 353 506d 2475d 23/28 fixed on 2023/10/12 12:47
upstream KMSAN: uninit-value in __netif_receive_skb_core (2) bpf net 22 280d 374d 0/28 closed as invalid on 2024/05/28 18:05
linux-4.19 KASAN: use-after-free Read in __netif_receive_skb_core syz error 20 1024d 1565d 0/1 upstream: reported syz repro on 2020/10/08 04:31
upstream KASAN: null-ptr-deref Read in __netif_receive_skb_core wireguard 8 714d 993d 0/28 auto-obsoleted due to no activity on 2023/05/19 08:04
linux-4.14 KASAN: use-after-free Read in __netif_receive_skb_core syz error 19 1293d 1710d 0/1 upstream: reported syz repro on 2020/05/16 19:24

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in __netif_receive_skb_core+0x555/0x6c90 net/core/dev.c:5500
 __netif_receive_skb_core+0x555/0x6c90 net/core/dev.c:5500
 __netif_receive_skb_list_core+0x31e/0x1670 net/core/dev.c:5745
 __netif_receive_skb_list net/core/dev.c:5812 [inline]
 netif_receive_skb_list_internal+0x1085/0x1700 net/core/dev.c:5903
 netif_receive_skb_list+0x5a/0x460 net/core/dev.c:5955
 xdp_recv_frames net/bpf/test_run.c:280 [inline]
 xdp_test_run_batch net/bpf/test_run.c:361 [inline]
 bpf_test_run_xdp_live+0x2e72/0x3470 net/bpf/test_run.c:390
 bpf_prog_test_run_xdp+0xf1d/0x1ae0 net/bpf/test_run.c:1318
 bpf_prog_test_run+0x5e5/0xa30 kernel/bpf/syscall.c:4266
 __sys_bpf+0x6aa/0xd90 kernel/bpf/syscall.c:5671
 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
 __x64_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5758
 x64_sys_call+0x2cce/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:322
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
 __xdp_build_skb_from_frame+0x8d7/0x9e0 net/core/xdp.c:635
 xdp_recv_frames net/bpf/test_run.c:272 [inline]
 xdp_test_run_batch net/bpf/test_run.c:361 [inline]
 bpf_test_run_xdp_live+0x2a4a/0x3470 net/bpf/test_run.c:390
 bpf_prog_test_run_xdp+0xf1d/0x1ae0 net/bpf/test_run.c:1318
 bpf_prog_test_run+0x5e5/0xa30 kernel/bpf/syscall.c:4266
 __sys_bpf+0x6aa/0xd90 kernel/bpf/syscall.c:5671
 __do_sys_bpf kernel/bpf/syscall.c:5760 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5758 [inline]
 __x64_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5758
 x64_sys_call+0x2cce/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:322
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Local variable reuse.i created at:
 mas_wr_node_store lib/maple_tree.c:3798 [inline]
 mas_wr_store_entry+0x11f7/0x8b30 lib/maple_tree.c:4078
 mas_store_prealloc+0x15ab/0x19a0 lib/maple_tree.c:5520

CPU: 1 UID: 0 PID: 9374 Comm: syz.2.1089 Not tainted 6.12.0-rc6-syzkaller-00169-g906bd684e4b1 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024
=====================================================

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/11/08 11:54 upstream 906bd684e4b1 179b040e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in __netif_receive_skb_core
2024/11/16 08:26 upstream f868cd251776 cfe3a04a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in __netif_receive_skb_core
2024/11/08 01:05 upstream ff7afaeca1a1 c069283c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in __netif_receive_skb_core
* Struck through repros no longer work on HEAD.