From: syzbot <syzbot+b024befb3ca7990fea37@syzkaller.appspotmail.com>
To: coreteam@netfilter.org, davem@davemloft.net, fw@strlen.de,
glider@google.com, kadlec@netfilter.org, kuba@kernel.org,
kuznet@ms2.inr.ac.ru, linux-kernel@vger.kernel.org,
netdev@vger.kernel.org, netfilter-devel@vger.kernel.org,
pablo@netfilter.org, syzkaller-bugs@googlegroups.com,
yoshfuji@linux-ipv6.org
Subject: Re: KMSAN: uninit-value in __skb_checksum_complete (5)
Date: Wed, 02 Dec 2020 04:11:15 -0800 [thread overview]
Message-ID: <000000000000d9bf1205b57a23f6@google.com> (raw)
In-Reply-To: <000000000000f3ffc205acd7cd06@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: 73d62e81 kmsan: random: prevent boot-time reports in _mix_..
git tree: https://github.com/google/kmsan.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=13bd4607500000
kernel config: https://syzkaller.appspot.com/x/.config?x=eef728deea880383
dashboard link: https://syzkaller.appspot.com/bug?extid=b024befb3ca7990fea37
compiler: clang version 11.0.0 (https://github.com/llvm/llvm-project.git ca2dcbd030eadbf0aa9b660efe864ff08af6e18b)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=126c8379500000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17cdf7b5500000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b024befb3ca7990fea37@syzkaller.appspotmail.com
=====================================================
BUG: KMSAN: uninit-value in __skb_checksum_complete+0x421/0x630 net/core/skbuff.c:2846
CPU: 0 PID: 497 Comm: kworker/u4:11 Not tainted 5.10.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x21c/0x280 lib/dump_stack.c:118
kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118
__msan_warning+0x5f/0xa0 mm/kmsan/kmsan_instr.c:197
__skb_checksum_complete+0x421/0x630 net/core/skbuff.c:2846
__skb_checksum_validate_complete include/linux/skbuff.h:4014 [inline]
icmp_rcv+0x94b/0x1d70 net/ipv4/icmp.c:1081
ip_protocol_deliver_rcu+0x572/0xc50 net/ipv4/ip_input.c:204
ip_local_deliver_finish net/ipv4/ip_input.c:231 [inline]
NF_HOOK include/linux/netfilter.h:301 [inline]
ip_local_deliver+0x583/0x8d0 net/ipv4/ip_input.c:252
dst_input include/net/dst.h:449 [inline]
ip_rcv_finish net/ipv4/ip_input.c:428 [inline]
NF_HOOK include/linux/netfilter.h:301 [inline]
ip_rcv+0x5c3/0x840 net/ipv4/ip_input.c:539
__netif_receive_skb_one_core net/core/dev.c:5315 [inline]
__netif_receive_skb+0x1ec/0x640 net/core/dev.c:5429
process_backlog+0x523/0xc10 net/core/dev.c:6319
napi_poll+0x420/0x1010 net/core/dev.c:6763
net_rx_action+0x35c/0xd40 net/core/dev.c:6833
__do_softirq+0x1a9/0x6fa kernel/softirq.c:298
asm_call_irq_on_stack+0xf/0x20
</IRQ>
__run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
do_softirq_own_stack+0x6e/0x90 arch/x86/kernel/irq_64.c:77
do_softirq kernel/softirq.c:343 [inline]
__local_bh_enable_ip+0x184/0x1d0 kernel/softirq.c:195
local_bh_enable+0x36/0x40 include/linux/bottom_half.h:32
rcu_read_unlock_bh include/linux/rcupdate.h:730 [inline]
__dev_queue_xmit+0x3a9b/0x4520 net/core/dev.c:4167
dev_queue_xmit+0x4b/0x60 net/core/dev.c:4173
batadv_send_skb_packet+0x622/0x970 net/batman-adv/send.c:108
batadv_send_broadcast_skb+0x76/0x90 net/batman-adv/send.c:127
batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:394 [inline]
batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:420 [inline]
batadv_iv_send_outstanding_bat_ogm_packet+0xb3a/0xf00 net/batman-adv/bat_iv_ogm.c:1712
process_one_work+0x121c/0x1fc0 kernel/workqueue.c:2272
worker_thread+0x10cc/0x2740 kernel/workqueue.c:2418
kthread+0x51c/0x560 kernel/kthread.c:292
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296
Uninit was stored to memory at:
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:121 [inline]
kmsan_internal_chain_origin+0xad/0x130 mm/kmsan/kmsan.c:289
kmsan_memcpy_memmove_metadata+0x25e/0x2d0 mm/kmsan/kmsan.c:226
kmsan_memcpy_metadata+0xb/0x10 mm/kmsan/kmsan.c:246
__msan_memcpy+0x46/0x60 mm/kmsan/kmsan_instr.c:110
csum_partial_copy_nocheck include/net/checksum.h:51 [inline]
skb_copy_and_csum_bits+0x23e/0x13e0 net/core/skbuff.c:2733
icmp_glue_bits+0x155/0x400 net/ipv4/icmp.c:356
__ip_append_data+0x4f8e/0x6210 net/ipv4/ip_output.c:1139
ip_append_data+0x326/0x490 net/ipv4/ip_output.c:1323
icmp_push_reply+0x1f8/0x810 net/ipv4/icmp.c:374
__icmp_send+0x2a98/0x3a90 net/ipv4/icmp.c:762
icmp_send include/net/icmp.h:43 [inline]
__udp4_lib_rcv+0x421f/0x5880 net/ipv4/udp.c:2405
udp_rcv+0x5c/0x70 net/ipv4/udp.c:2564
ip_protocol_deliver_rcu+0x572/0xc50 net/ipv4/ip_input.c:204
ip_local_deliver_finish net/ipv4/ip_input.c:231 [inline]
NF_HOOK include/linux/netfilter.h:301 [inline]
ip_local_deliver+0x583/0x8d0 net/ipv4/ip_input.c:252
dst_input include/net/dst.h:449 [inline]
ip_rcv_finish net/ipv4/ip_input.c:428 [inline]
NF_HOOK include/linux/netfilter.h:301 [inline]
ip_rcv+0x5c3/0x840 net/ipv4/ip_input.c:539
__netif_receive_skb_one_core net/core/dev.c:5315 [inline]
__netif_receive_skb+0x1ec/0x640 net/core/dev.c:5429
process_backlog+0x523/0xc10 net/core/dev.c:6319
napi_poll+0x420/0x1010 net/core/dev.c:6763
net_rx_action+0x35c/0xd40 net/core/dev.c:6833
__do_softirq+0x1a9/0x6fa kernel/softirq.c:298
Uninit was stored to memory at:
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:121 [inline]
kmsan_internal_chain_origin+0xad/0x130 mm/kmsan/kmsan.c:289
kmsan_memcpy_memmove_metadata+0x25e/0x2d0 mm/kmsan/kmsan.c:226
kmsan_memcpy_metadata+0xb/0x10 mm/kmsan/kmsan.c:246
__msan_memcpy+0x46/0x60 mm/kmsan/kmsan_instr.c:110
pskb_expand_head+0x3eb/0x1df0 net/core/skbuff.c:1631
__skb_cow include/linux/skbuff.h:3165 [inline]
skb_cow_head include/linux/skbuff.h:3199 [inline]
batadv_skb_head_push+0x2ce/0x410 net/batman-adv/soft-interface.c:75
batadv_send_skb_packet+0x1ed/0x970 net/batman-adv/send.c:86
batadv_send_broadcast_skb+0x76/0x90 net/batman-adv/send.c:127
batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:394 [inline]
batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:420 [inline]
batadv_iv_send_outstanding_bat_ogm_packet+0xb3a/0xf00 net/batman-adv/bat_iv_ogm.c:1712
process_one_work+0x121c/0x1fc0 kernel/workqueue.c:2272
worker_thread+0x10cc/0x2740 kernel/workqueue.c:2418
kthread+0x51c/0x560 kernel/kthread.c:292
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296
Uninit was created at:
kmsan_save_stack_with_flags+0x3c/0x90 mm/kmsan/kmsan.c:121
kmsan_alloc_page+0xd3/0x1f0 mm/kmsan/kmsan_shadow.c:274
__alloc_pages_nodemask+0x84e/0xfb0 mm/page_alloc.c:4989
__alloc_pages include/linux/gfp.h:511 [inline]
__alloc_pages_node include/linux/gfp.h:524 [inline]
alloc_pages_node include/linux/gfp.h:538 [inline]
__page_frag_cache_refill mm/page_alloc.c:5065 [inline]
page_frag_alloc+0x35b/0x890 mm/page_alloc.c:5095
__napi_alloc_skb+0x1c0/0xab0 net/core/skbuff.c:519
napi_alloc_skb include/linux/skbuff.h:2870 [inline]
page_to_skb+0x142/0x1640 drivers/net/virtio_net.c:389
receive_mergeable+0xee6/0x5be0 drivers/net/virtio_net.c:949
receive_buf+0x2db/0x2ba0 drivers/net/virtio_net.c:1059
virtnet_receive drivers/net/virtio_net.c:1351 [inline]
virtnet_poll+0xa51/0x1d10 drivers/net/virtio_net.c:1456
napi_poll+0x420/0x1010 net/core/dev.c:6763
net_rx_action+0x35c/0xd40 net/core/dev.c:6833
__do_softirq+0x1a9/0x6fa kernel/softirq.c:298
=====================================================
prev parent reply other threads:[~2020-12-02 12:11 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-08-14 15:09 KMSAN: uninit-value in __skb_checksum_complete (5) syzbot
2020-12-02 12:11 ` syzbot [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000d9bf1205b57a23f6@google.com \
--to=syzbot+b024befb3ca7990fea37@syzkaller.appspotmail.com \
--cc=coreteam@netfilter.org \
--cc=davem@davemloft.net \
--cc=fw@strlen.de \
--cc=glider@google.com \
--cc=kadlec@netfilter.org \
--cc=kuba@kernel.org \
--cc=kuznet@ms2.inr.ac.ru \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=yoshfuji@linux-ipv6.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.