* [syzbot] [bpf?] KMSAN: uninit-value in bpf_prog_test_run_skb @ 2025-12-31 6:02 syzbot 2026-01-14 13:56 ` [PATCH] net: skbuff: fix uninitialized memory use in pskb_expand_head() Soham Metha 2026-01-26 11:43 ` [PATCH v2] net: skbuff: fix uninitialized memory use in pskb_expand_head() Soham Metha 0 siblings, 2 replies; 5+ messages in thread From: syzbot @ 2025-12-31 6:02 UTC (permalink / raw) To: andrii, ast, bpf, daniel, eddyz87, haoluo, john.fastabend, jolsa, kpsingh, linux-kernel, martin.lau, sdf, song, syzkaller-bugs, yonghong.song Hello, syzbot found the following issue on: HEAD commit: 3f0e9c8cefa9 Merge tag 'block-6.19-20251226' of git://git... git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=14d784fc580000 kernel config: https://syzkaller.appspot.com/x/.config?x=b3903bdf68407a14 dashboard link: https://syzkaller.appspot.com/bug?extid=619b9ef527f510a57cfc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=151f1b92580000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=144f5022580000 Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/7f2d5650d243/disk-3f0e9c8c.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/069034860f2d/vmlinux-3f0e9c8c.xz kernel image: https://storage.googleapis.com/syzbot-assets/90d1c240dc1b/bzImage-3f0e9c8c.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+619b9ef527f510a57cfc@syzkaller.appspotmail.com ===================================================== BUG: KMSAN: uninit-value in bpf_prog_test_run_skb+0x3091/0x3200 net/bpf/test_run.c:-1 bpf_prog_test_run_skb+0x3091/0x3200 net/bpf/test_run.c:-1 bpf_prog_test_run+0x5bb/0x9f0 kernel/bpf/syscall.c:4703 __sys_bpf+0x873/0xeb0 kernel/bpf/syscall.c:6182 __do_sys_bpf kernel/bpf/syscall.c:6274 [inline] __se_sys_bpf kernel/bpf/syscall.c:6272 [inline] __x64_sys_bpf+0xa4/0xf0 kernel/bpf/syscall.c:6272 x64_sys_call+0x31c3/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:322 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was stored to memory at: pskb_expand_head+0x310/0x15d0 net/core/skbuff.c:2290 __skb_cow include/linux/skbuff.h:3853 [inline] skb_cow_head include/linux/skbuff.h:3887 [inline] bpf_skb_net_grow net/core/filter.c:3511 [inline] ____bpf_skb_adjust_room net/core/filter.c:3754 [inline] bpf_skb_adjust_room+0x103c/0x3310 net/core/filter.c:3699 ___bpf_prog_run+0x1297/0xeba0 kernel/bpf/core.c:2037 __bpf_prog_run512+0xc5/0x100 kernel/bpf/core.c:2333 bpf_dispatcher_nop_func include/linux/bpf.h:1378 [inline] __bpf_prog_run include/linux/filter.h:723 [inline] bpf_prog_run include/linux/filter.h:730 [inline] bpf_test_run+0x496/0xe00 net/bpf/test_run.c:423 bpf_prog_test_run_skb+0x2377/0x3200 net/bpf/test_run.c:1158 bpf_prog_test_run+0x5bb/0x9f0 kernel/bpf/syscall.c:4703 __sys_bpf+0x873/0xeb0 kernel/bpf/syscall.c:6182 __do_sys_bpf kernel/bpf/syscall.c:6274 [inline] __se_sys_bpf kernel/bpf/syscall.c:6272 [inline] __x64_sys_bpf+0xa4/0xf0 kernel/bpf/syscall.c:6272 x64_sys_call+0x31c3/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:322 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was stored to memory at: skb_data_move+0x424/0x570 include/linux/skbuff.h:-1 skb_postpush_data_move include/linux/skbuff.h:4639 [inline] bpf_skb_generic_push net/core/filter.c:3267 [inline] bpf_skb_net_hdr_push net/core/filter.c:3305 [inline] bpf_skb_net_grow net/core/filter.c:3542 [inline] ____bpf_skb_adjust_room net/core/filter.c:3754 [inline] bpf_skb_adjust_room+0x116c/0x3310 net/core/filter.c:3699 ___bpf_prog_run+0x1297/0xeba0 kernel/bpf/core.c:2037 __bpf_prog_run512+0xc5/0x100 kernel/bpf/core.c:2333 bpf_dispatcher_nop_func include/linux/bpf.h:1378 [inline] __bpf_prog_run include/linux/filter.h:723 [inline] bpf_prog_run include/linux/filter.h:730 [inline] bpf_test_run+0x496/0xe00 net/bpf/test_run.c:423 bpf_prog_test_run_skb+0x2377/0x3200 net/bpf/test_run.c:1158 bpf_prog_test_run+0x5bb/0x9f0 kernel/bpf/syscall.c:4703 __sys_bpf+0x873/0xeb0 kernel/bpf/syscall.c:6182 __do_sys_bpf kernel/bpf/syscall.c:6274 [inline] __se_sys_bpf kernel/bpf/syscall.c:6272 [inline] __x64_sys_bpf+0xa4/0xf0 kernel/bpf/syscall.c:6272 x64_sys_call+0x31c3/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:322 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: slab_post_alloc_hook mm/slub.c:4960 [inline] slab_alloc_node mm/slub.c:5263 [inline] kmem_cache_alloc_node_noprof+0x9e7/0x17a0 mm/slub.c:5315 kmalloc_reserve+0x13c/0x4b0 net/core/skbuff.c:586 pskb_expand_head+0x1fc/0x15d0 net/core/skbuff.c:2282 __skb_cow include/linux/skbuff.h:3853 [inline] skb_cow_head include/linux/skbuff.h:3887 [inline] bpf_skb_net_grow net/core/filter.c:3511 [inline] ____bpf_skb_adjust_room net/core/filter.c:3754 [inline] bpf_skb_adjust_room+0x103c/0x3310 net/core/filter.c:3699 ___bpf_prog_run+0x1297/0xeba0 kernel/bpf/core.c:2037 __bpf_prog_run512+0xc5/0x100 kernel/bpf/core.c:2333 bpf_dispatcher_nop_func include/linux/bpf.h:1378 [inline] __bpf_prog_run include/linux/filter.h:723 [inline] bpf_prog_run include/linux/filter.h:730 [inline] bpf_test_run+0x496/0xe00 net/bpf/test_run.c:423 bpf_prog_test_run_skb+0x2377/0x3200 net/bpf/test_run.c:1158 bpf_prog_test_run+0x5bb/0x9f0 kernel/bpf/syscall.c:4703 __sys_bpf+0x873/0xeb0 kernel/bpf/syscall.c:6182 __do_sys_bpf kernel/bpf/syscall.c:6274 [inline] __se_sys_bpf kernel/bpf/syscall.c:6272 [inline] __x64_sys_bpf+0xa4/0xf0 kernel/bpf/syscall.c:6272 x64_sys_call+0x31c3/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:322 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 1 UID: 0 PID: 6072 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(none) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 ===================================================== --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the report is already addressed, let syzbot know by replying with: #syz fix: exact-commit-title If you want syzbot to run the reproducer, reply with: #syz test: git://repo/address.git branch-or-commit-hash If you attach or paste a git patch, syzbot will apply it before testing. If you want to overwrite report's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the report is a duplicate of another one, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup ^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH] net: skbuff: fix uninitialized memory use in pskb_expand_head() 2025-12-31 6:02 [syzbot] [bpf?] KMSAN: uninit-value in bpf_prog_test_run_skb syzbot @ 2026-01-14 13:56 ` Soham Metha 2026-01-14 15:06 ` [syzbot] [bpf?] KMSAN: uninit-value in bpf_prog_test_run_skb syzbot 2026-01-26 11:43 ` [PATCH v2] net: skbuff: fix uninitialized memory use in pskb_expand_head() Soham Metha 1 sibling, 1 reply; 5+ messages in thread From: Soham Metha @ 2026-01-14 13:56 UTC (permalink / raw) To: linux-kernel-mentees Cc: shuah, syzbot+619b9ef527f510a57cfc, syzkaller-bugs, andrii, ast, bpf, daniel, eddyz87, haoluo, john.fastabend, jolsa, kpsingh, linux-kernel, martin.lau, sdf, song, yonghong.song, Soham Metha pskb_expand_head() allocates a new skb data buffer using kmalloc_reserve(), which does not initialize memory. skb helpers may later copy or move padding bytes from the buffer. Initialize the newly allocated skb buffer to avoid propagating uninitialized memory. Reported-by: syzbot+619b9ef527f510a57cfc@syzkaller.appspotmail.com Signed-off-by: Soham Metha <sohammetha01@gmail.com> --- #syz test net/core/skbuff.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index a56133902c0d..b0f0d3a0310b 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -2282,6 +2282,9 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail, data = kmalloc_reserve(&size, gfp_mask, NUMA_NO_NODE, NULL); if (!data) goto nodata; + + memset(data, 0, size); + size = SKB_WITH_OVERHEAD(size); /* Copy only real data... and, alas, header. This should be -- 2.34.1 ^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [syzbot] [bpf?] KMSAN: uninit-value in bpf_prog_test_run_skb 2026-01-14 13:56 ` [PATCH] net: skbuff: fix uninitialized memory use in pskb_expand_head() Soham Metha @ 2026-01-14 15:06 ` syzbot 0 siblings, 0 replies; 5+ messages in thread From: syzbot @ 2026-01-14 15:06 UTC (permalink / raw) To: andrii, ast, bpf, daniel, eddyz87, haoluo, john.fastabend, jolsa, kpsingh, linux-kernel-mentees, linux-kernel, martin.lau, sdf, shuah, sohammetha01, song, syzkaller-bugs, yonghong.song Hello, syzbot has tested the proposed patch and the reproducer did not trigger any issue: Reported-by: syzbot+619b9ef527f510a57cfc@syzkaller.appspotmail.com Tested-by: syzbot+619b9ef527f510a57cfc@syzkaller.appspotmail.com Tested on: commit: c537e12d Merge tag 'bpf-fixes' of git://git.kernel.org.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=12188522580000 kernel config: https://syzkaller.appspot.com/x/.config?x=46b5f80a6e7aaa5c dashboard link: https://syzkaller.appspot.com/bug?extid=619b9ef527f510a57cfc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 patch: https://syzkaller.appspot.com/x/patch.diff?x=15f21d9a580000 Note: testing is done by a robot and is best-effort only. ^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH v2] net: skbuff: fix uninitialized memory use in pskb_expand_head() 2025-12-31 6:02 [syzbot] [bpf?] KMSAN: uninit-value in bpf_prog_test_run_skb syzbot 2026-01-14 13:56 ` [PATCH] net: skbuff: fix uninitialized memory use in pskb_expand_head() Soham Metha @ 2026-01-26 11:43 ` Soham Metha 2026-01-26 13:26 ` Eric Dumazet 1 sibling, 1 reply; 5+ messages in thread From: Soham Metha @ 2026-01-26 11:43 UTC (permalink / raw) To: linux-kernel-mentees Cc: shuah, skhan, linux-kernel, syzbot+619b9ef527f510a57cfc, syzkaller-bugs, andrii, ast, bpf, daniel, eddyz87, haoluo, john.fastabend, jolsa, kpsingh, martin.lau, sdf, song, yonghong.song, Soham Metha, David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman, Jason Xing, Kuniyuki Iwashima, Michal Luczaj, Mina Almasry, Eric Biggers, Alexander Lobakin, netdev pskb_expand_head() allocates a new skb data buffer using kmalloc_reserve(), which does not initialize memory. skb helpers may later copy or move padding bytes from the buffer. Initialize the newly allocated skb buffer to avoid propagating uninitialized memory. Reported-by: syzbot+619b9ef527f510a57cfc@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=619b9ef527f510a57cfc Tested-by: syzbot+619b9ef527f510a57cfc@syzkaller.appspotmail.com Signed-off-by: Soham Metha <sohammetha01@gmail.com> --- v2: - No code changes - Resent to netdev list - Added Closes tag - Added Tested-by tag net/core/skbuff.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index a56133902c0d..b0f0d3a0310b 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -2282,6 +2282,9 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail, data = kmalloc_reserve(&size, gfp_mask, NUMA_NO_NODE, NULL); if (!data) goto nodata; + + memset(data, 0, size); + size = SKB_WITH_OVERHEAD(size); /* Copy only real data... and, alas, header. This should be -- 2.34.1 ^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH v2] net: skbuff: fix uninitialized memory use in pskb_expand_head() 2026-01-26 11:43 ` [PATCH v2] net: skbuff: fix uninitialized memory use in pskb_expand_head() Soham Metha @ 2026-01-26 13:26 ` Eric Dumazet 0 siblings, 0 replies; 5+ messages in thread From: Eric Dumazet @ 2026-01-26 13:26 UTC (permalink / raw) To: Soham Metha Cc: linux-kernel-mentees, shuah, skhan, linux-kernel, syzbot+619b9ef527f510a57cfc, syzkaller-bugs, andrii, ast, bpf, daniel, eddyz87, haoluo, john.fastabend, jolsa, kpsingh, martin.lau, sdf, song, yonghong.song, David S. Miller, Jakub Kicinski, Paolo Abeni, Simon Horman, Jason Xing, Kuniyuki Iwashima, Michal Luczaj, Mina Almasry, Eric Biggers, Alexander Lobakin, netdev On Mon, Jan 26, 2026 at 2:22 PM Soham Metha <sohammetha01@gmail.com> wrote: > > pskb_expand_head() allocates a new skb data buffer using > kmalloc_reserve(), which does not initialize memory. skb helpers may > later copy or move padding bytes from the buffer. > > Initialize the newly allocated skb buffer to avoid propagating > uninitialized memory. > > Reported-by: syzbot+619b9ef527f510a57cfc@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=619b9ef527f510a57cfc > Tested-by: syzbot+619b9ef527f510a57cfc@syzkaller.appspotmail.com > Signed-off-by: Soham Metha <sohammetha01@gmail.com> > --- > > v2: > - No code changes > - Resent to netdev list > - Added Closes tag > - Added Tested-by tag > > net/core/skbuff.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/net/core/skbuff.c b/net/core/skbuff.c > index a56133902c0d..b0f0d3a0310b 100644 > --- a/net/core/skbuff.c > +++ b/net/core/skbuff.c > @@ -2282,6 +2282,9 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail, > data = kmalloc_reserve(&size, gfp_mask, NUMA_NO_NODE, NULL); > if (!data) > goto nodata; > + > + memset(data, 0, size); > + > Certainly not. You might wonder why we have GFP_ZERO ? Answer : we do not generally want to pay the price of zeroing memory _unless_ absolutely needed. Fix the caller instead, ie root-cause the issue, thank you ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-01-26 13:34 UTC | newest] Thread overview: 5+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2025-12-31 6:02 [syzbot] [bpf?] KMSAN: uninit-value in bpf_prog_test_run_skb syzbot 2026-01-14 13:56 ` [PATCH] net: skbuff: fix uninitialized memory use in pskb_expand_head() Soham Metha 2026-01-14 15:06 ` [syzbot] [bpf?] KMSAN: uninit-value in bpf_prog_test_run_skb syzbot 2026-01-26 11:43 ` [PATCH v2] net: skbuff: fix uninitialized memory use in pskb_expand_head() Soham Metha 2026-01-26 13:26 ` Eric Dumazet
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox