From: syzbot <syzbot+0e6ddb1ef80986bdfe64@syzkaller.appspotmail.com>
To: andrii@kernel.org, ast@kernel.org, ben-linux@fluff.org,
bp@alien8.de, bpf@vger.kernel.org,
daniel.sneddon@linux.intel.com, daniel@iogearbox.net,
dave.hansen@linux.intel.com, glider@google.com, hpa@zytor.com,
linux-can@vger.kernel.org, linux-kernel@vger.kernel.org,
mingo@redhat.com, mkl@pengutronix.de, netdev@vger.kernel.org,
pbonzini@redhat.com, sathyanarayanan.kuppuswamy@linux.intel.com,
syzkaller-bugs@googlegroups.com, tglx@linutronix.de,
x86@kernel.org, xrivendell7@gmail.com
Subject: Re: [syzbot] [can?] [bpf?] KMSAN: uninit-value in bpf_prog_run_generic_xdp
Date: Sat, 16 Mar 2024 09:19:23 -0700 [thread overview]
Message-ID: <000000000000d5c35b0613c97c85@google.com> (raw)
In-Reply-To: <00000000000067f65105edbd295d@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: 66a27abac311 Merge tag 'powerpc-6.9-1' of git://git.kernel..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=14285ac9180000
kernel config: https://syzkaller.appspot.com/x/.config?x=48bb382b96e7eda7
dashboard link: https://syzkaller.appspot.com/bug?extid=0e6ddb1ef80986bdfe64
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17ab51c9180000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=127d21f1180000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/37968fa0451e/disk-66a27aba.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/5b288c5c3088/vmlinux-66a27aba.xz
kernel image: https://storage.googleapis.com/syzbot-assets/792ddbf8146d/bzImage-66a27aba.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0e6ddb1ef80986bdfe64@syzkaller.appspotmail.com
=====================================================
BUG: KMSAN: uninit-value in bpf_prog_run_generic_xdp+0x13a0/0x1ee0 net/core/dev.c:4876
bpf_prog_run_generic_xdp+0x13a0/0x1ee0 net/core/dev.c:4876
netif_receive_generic_xdp net/core/dev.c:4958 [inline]
do_xdp_generic+0xb68/0x1440 net/core/dev.c:5017
__netif_receive_skb_core+0x2533/0x6190 net/core/dev.c:5358
__netif_receive_skb_one_core net/core/dev.c:5536 [inline]
__netif_receive_skb+0xca/0xa00 net/core/dev.c:5652
process_backlog+0x480/0x8b0 net/core/dev.c:5981
__napi_poll+0xe7/0x980 net/core/dev.c:6632
napi_poll net/core/dev.c:6701 [inline]
net_rx_action+0x89d/0x1820 net/core/dev.c:6813
__do_softirq+0x1c0/0x7d7 kernel/softirq.c:554
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu kernel/softirq.c:633 [inline]
irq_exit_rcu+0x6a/0x130 kernel/softirq.c:645
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0x83/0x90 arch/x86/kernel/apic/apic.c:1043
asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:702
__preempt_count_dec_and_test arch/x86/include/asm/preempt.h:94 [inline]
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
_raw_spin_unlock_irqrestore+0x33/0x60 kernel/locking/spinlock.c:194
unlock_hrtimer_base kernel/time/hrtimer.c:1021 [inline]
hrtimer_start_range_ns+0x112c/0x11a0 kernel/time/hrtimer.c:1308
hrtimer_start include/linux/hrtimer.h:275 [inline]
j1939_tp_schedule_txtimer+0xc2/0x100 net/can/j1939/transport.c:702
j1939_sk_send_loop net/can/j1939/socket.c:1164 [inline]
j1939_sk_sendmsg+0x1a0e/0x2730 net/can/j1939/socket.c:1277
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0x30f/0x380 net/socket.c:745
____sys_sendmsg+0x877/0xb60 net/socket.c:2584
___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638
__sys_sendmsg net/socket.c:2667 [inline]
__do_sys_sendmsg net/socket.c:2676 [inline]
__se_sys_sendmsg net/socket.c:2674 [inline]
__x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2674
do_syscall_64+0xd5/0x1f0
entry_SYSCALL_64_after_hwframe+0x6d/0x75
Uninit was stored to memory at:
pskb_expand_head+0x30f/0x19d0 net/core/skbuff.c:2253
netif_skb_check_for_xdp net/core/dev.c:4921 [inline]
netif_receive_generic_xdp net/core/dev.c:4952 [inline]
do_xdp_generic+0x931/0x1440 net/core/dev.c:5017
__netif_receive_skb_core+0x2533/0x6190 net/core/dev.c:5358
__netif_receive_skb_one_core net/core/dev.c:5536 [inline]
__netif_receive_skb+0xca/0xa00 net/core/dev.c:5652
process_backlog+0x480/0x8b0 net/core/dev.c:5981
__napi_poll+0xe7/0x980 net/core/dev.c:6632
napi_poll net/core/dev.c:6701 [inline]
net_rx_action+0x89d/0x1820 net/core/dev.c:6813
__do_softirq+0x1c0/0x7d7 kernel/softirq.c:554
Uninit was created at:
slab_post_alloc_hook mm/slub.c:3804 [inline]
slab_alloc_node mm/slub.c:3845 [inline]
kmem_cache_alloc_node+0x613/0xc50 mm/slub.c:3888
kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577
__alloc_skb+0x35b/0x7a0 net/core/skbuff.c:668
alloc_skb include/linux/skbuff.h:1318 [inline]
alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6504
sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2795
sock_alloc_send_skb include/net/sock.h:1835 [inline]
j1939_sk_alloc_skb net/can/j1939/socket.c:878 [inline]
j1939_sk_send_loop net/can/j1939/socket.c:1142 [inline]
j1939_sk_sendmsg+0xc0a/0x2730 net/can/j1939/socket.c:1277
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0x30f/0x380 net/socket.c:745
____sys_sendmsg+0x877/0xb60 net/socket.c:2584
___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638
__sys_sendmsg net/socket.c:2667 [inline]
__do_sys_sendmsg net/socket.c:2676 [inline]
__se_sys_sendmsg net/socket.c:2674 [inline]
__x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2674
do_syscall_64+0xd5/0x1f0
entry_SYSCALL_64_after_hwframe+0x6d/0x75
CPU: 0 PID: 5044 Comm: syz-executor640 Not tainted 6.8.0-syzkaller-11136-g66a27abac311 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
=====================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
next prev parent reply other threads:[~2024-03-16 16:19 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-18 11:39 [syzbot] KMSAN: uninit-value in bpf_prog_run_generic_xdp syzbot
2024-03-16 16:19 ` syzbot [this message]
2024-07-01 10:19 ` [syzbot] " syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000d5c35b0613c97c85@google.com \
--to=syzbot+0e6ddb1ef80986bdfe64@syzkaller.appspotmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=ben-linux@fluff.org \
--cc=bp@alien8.de \
--cc=bpf@vger.kernel.org \
--cc=daniel.sneddon@linux.intel.com \
--cc=daniel@iogearbox.net \
--cc=dave.hansen@linux.intel.com \
--cc=glider@google.com \
--cc=hpa@zytor.com \
--cc=linux-can@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=mkl@pengutronix.de \
--cc=netdev@vger.kernel.org \
--cc=pbonzini@redhat.com \
--cc=sathyanarayanan.kuppuswamy@linux.intel.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
--cc=xrivendell7@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.