syzbot

 sign-in | mailing list | source | docs
🐞 Open [1511]
≡ Subsystems
🐞 Fixed [5887]
🐞 Invalid [14312]
⬇ Missing Backports [96]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
💬 Send us feedback

KMSAN: uninit-value in nf_reject_ip6_tcphdr_put

Status: fixed on 2024/10/22 11:57
Subsystems: netfilter
[Documentation on labels]
Fix commit: 9c778fe48d20 UPSTREAM: netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
First crash: 82d, last: 69d

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in nf_reject_ip6_tcphdr_put+0x688/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:255
 nf_reject_ip6_tcphdr_put+0x688/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:255
 nf_send_reset6+0xd84/0x15b0 net/ipv6/netfilter/nf_reject_ipv6.c:344
 nft_reject_inet_eval+0x3c1/0x880 net/netfilter/nft_reject_inet.c:48
 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline]
 nft_do_chain+0x426/0x2290 net/netfilter/nf_tables_core.c:288
 nft_do_chain_inet+0x41a/0x4f0 net/netfilter/nft_chain_filter.c:161
 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]
 nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626
 nf_hook include/linux/netfilter.h:269 [inline]
 NF_HOOK include/linux/netfilter.h:312 [inline]
 ipv6_rcv+0x29b/0x390 net/ipv6/ip6_input.c:309
 __netif_receive_skb_one_core net/core/dev.c:5662 [inline]
 __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5775
 netif_receive_skb_internal net/core/dev.c:5861 [inline]
 netif_receive_skb+0x58/0x660 net/core/dev.c:5920
 tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1550
 tun_get_user+0x5783/0x6c60 drivers/net/tun.c:2007
 tun_chr_write_iter+0x3ac/0x5d0 drivers/net/tun.c:2053
 new_sync_write fs/read_write.c:590 [inline]
 vfs_write+0xb28/0x1540 fs/read_write.c:683
 ksys_write+0x20f/0x4c0 fs/read_write.c:736
 __do_sys_write fs/read_write.c:748 [inline]
 __se_sys_write fs/read_write.c:745 [inline]
 __x64_sys_write+0x93/0xe0 fs/read_write.c:745
 x64_sys_call+0x306a/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
 nf_reject_ip6_tcphdr_put+0x60c/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:249
 nf_send_reset6+0xd84/0x15b0 net/ipv6/netfilter/nf_reject_ipv6.c:344
 nft_reject_inet_eval+0x3c1/0x880 net/netfilter/nft_reject_inet.c:48
 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline]
 nft_do_chain+0x426/0x2290 net/netfilter/nf_tables_core.c:288
 nft_do_chain_inet+0x41a/0x4f0 net/netfilter/nft_chain_filter.c:161
 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]
 nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626
 nf_hook include/linux/netfilter.h:269 [inline]
 NF_HOOK include/linux/netfilter.h:312 [inline]
 ipv6_rcv+0x29b/0x390 net/ipv6/ip6_input.c:309
 __netif_receive_skb_one_core net/core/dev.c:5662 [inline]
 __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5775
 netif_receive_skb_internal net/core/dev.c:5861 [inline]
 netif_receive_skb+0x58/0x660 net/core/dev.c:5920
 tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1550
 tun_get_user+0x5783/0x6c60 drivers/net/tun.c:2007
 tun_chr_write_iter+0x3ac/0x5d0 drivers/net/tun.c:2053
 new_sync_write fs/read_write.c:590 [inline]
 vfs_write+0xb28/0x1540 fs/read_write.c:683
 ksys_write+0x20f/0x4c0 fs/read_write.c:736
 __do_sys_write fs/read_write.c:748 [inline]
 __se_sys_write fs/read_write.c:745 [inline]
 __x64_sys_write+0x93/0xe0 fs/read_write.c:745
 x64_sys_call+0x306a/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
 nf_reject_ip6_tcphdr_put+0x2ca/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:231
 nf_send_reset6+0xd84/0x15b0 net/ipv6/netfilter/nf_reject_ipv6.c:344
 nft_reject_inet_eval+0x3c1/0x880 net/netfilter/nft_reject_inet.c:48
 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline]
 nft_do_chain+0x426/0x2290 net/netfilter/nf_tables_core.c:288
 nft_do_chain_inet+0x41a/0x4f0 net/netfilter/nft_chain_filter.c:161
 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]
 nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626
 nf_hook include/linux/netfilter.h:269 [inline]
 NF_HOOK include/linux/netfilter.h:312 [inline]
 ipv6_rcv+0x29b/0x390 net/ipv6/ip6_input.c:309
 __netif_receive_skb_one_core net/core/dev.c:5662 [inline]
 __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5775
 netif_receive_skb_internal net/core/dev.c:5861 [inline]
 netif_receive_skb+0x58/0x660 net/core/dev.c:5920
 tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1550
 tun_get_user+0x5783/0x6c60 drivers/net/tun.c:2007
 tun_chr_write_iter+0x3ac/0x5d0 drivers/net/tun.c:2053
 new_sync_write fs/read_write.c:590 [inline]
 vfs_write+0xb28/0x1540 fs/read_write.c:683
 ksys_write+0x20f/0x4c0 fs/read_write.c:736
 __do_sys_write fs/read_write.c:748 [inline]
 __se_sys_write fs/read_write.c:745 [inline]
 __x64_sys_write+0x93/0xe0 fs/read_write.c:745
 x64_sys_call+0x306a/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
 slab_post_alloc_hook mm/slub.c:3995 [inline]
 slab_alloc_node mm/slub.c:4038 [inline]
 kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4081
 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:587
 __alloc_skb+0x363/0x7b0 net/core/skbuff.c:678
 alloc_skb include/linux/skbuff.h:1322 [inline]
 nf_send_reset6+0x98d/0x15b0 net/ipv6/netfilter/nf_reject_ipv6.c:327
 nft_reject_inet_eval+0x3c1/0x880 net/netfilter/nft_reject_inet.c:48
 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline]
 nft_do_chain+0x426/0x2290 net/netfilter/nf_tables_core.c:288
 nft_do_chain_inet+0x41a/0x4f0 net/netfilter/nft_chain_filter.c:161
 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]
 nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626
 nf_hook include/linux/netfilter.h:269 [inline]
 NF_HOOK include/linux/netfilter.h:312 [inline]
 ipv6_rcv+0x29b/0x390 net/ipv6/ip6_input.c:309
 __netif_receive_skb_one_core net/core/dev.c:5662 [inline]
 __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5775
 netif_receive_skb_internal net/core/dev.c:5861 [inline]
 netif_receive_skb+0x58/0x660 net/core/dev.c:5920
 tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1550
 tun_get_user+0x5783/0x6c60 drivers/net/tun.c:2007
 tun_chr_write_iter+0x3ac/0x5d0 drivers/net/tun.c:2053
 new_sync_write fs/read_write.c:590 [inline]
 vfs_write+0xb28/0x1540 fs/read_write.c:683
 ksys_write+0x20f/0x4c0 fs/read_write.c:736
 __do_sys_write fs/read_write.c:748 [inline]
 __se_sys_write fs/read_write.c:745 [inline]
 __x64_sys_write+0x93/0xe0 fs/read_write.c:745
 x64_sys_call+0x306a/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 0 UID: 0 PID: 5177 Comm: syz-executor966 Not tainted 6.11.0-syzkaller-04557-g2f27fce67173 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
=====================================================

Crashes (136):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/09/18 03:46 upstream 2f27fce67173 c673ca06 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/26 20:03 upstream 11a299a7933e 0d19f247 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/26 18:43 upstream 11a299a7933e 0d19f247 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/26 07:51 upstream aa486552a110 0d19f247 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/26 04:38 upstream aa486552a110 0d19f247 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/26 03:31 upstream aa486552a110 0d19f247 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/25 23:29 upstream aa486552a110 349a68c4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/25 19:59 upstream 684a64bf32b6 349a68c4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/25 14:14 upstream 684a64bf32b6 349a68c4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/25 12:25 upstream 684a64bf32b6 349a68c4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/25 09:45 upstream 684a64bf32b6 349a68c4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/24 23:58 upstream 97d8894b6f4c 5643e0e9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/24 22:55 upstream 97d8894b6f4c 5643e0e9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/24 20:13 upstream abf2050f51fd 5643e0e9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/24 17:59 upstream abf2050f51fd 5643e0e9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/24 13:25 upstream abf2050f51fd 5643e0e9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/24 04:53 upstream abf2050f51fd 89298aad .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/24 01:14 upstream de5cb0dcb74c 89298aad .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/23 20:51 upstream de5cb0dcb74c 89298aad .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/23 17:11 upstream de5cb0dcb74c 89298aad .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/23 13:45 upstream de5cb0dcb74c 89298aad .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/23 11:11 upstream de5cb0dcb74c 6f888b75 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/23 09:28 upstream af9c191ac2a0 6f888b75 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/23 04:36 upstream af9c191ac2a0 6f888b75 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/22 21:54 upstream af9c191ac2a0 6f888b75 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/22 21:00 upstream af9c191ac2a0 6f888b75 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/22 18:34 upstream 88264981f208 6f888b75 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/22 09:38 upstream 88264981f208 6f888b75 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/22 03:52 upstream 88264981f208 6f888b75 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/21 07:36 upstream baeb9a7d8b60 6f888b75 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/20 23:50 upstream baeb9a7d8b60 6f888b75 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/20 00:08 upstream 839c4f596f89 6f888b75 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/19 16:03 upstream 839c4f596f89 6f888b75 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/18 08:45 upstream 2f27fce67173 c673ca06 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/18 08:44 upstream 2f27fce67173 c673ca06 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/23 21:57 upstream f8eb5bd9a818 89298aad .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/23 15:34 upstream de5cb0dcb74c 89298aad .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/23 01:30 upstream de5cb0dcb74c 6f888b75 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/21 21:06 upstream 7856a565416e 6f888b75 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/20 19:04 upstream baeb9a7d8b60 6f888b75 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/20 11:15 upstream baeb9a7d8b60 6f888b75 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/20 01:41 upstream 839c4f596f89 6f888b75 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/19 19:56 upstream 839c4f596f89 6f888b75 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/19 11:10 upstream 2a17bb8c204f c673ca06 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
2024/09/18 21:56 upstream 4a39ac5b7d62 c673ca06 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in nf_reject_ip6_tcphdr_put
* Struck through repros no longer work on HEAD.