From: syzbot <syzbot+d050d437fe47d479d210@syzkaller.appspotmail.com>
To: davem@davemloft.net, edumazet@google.com,
johannes.berg@intel.com, johannes@sipsolutions.net,
kuba@kernel.org, linux-kernel@vger.kernel.org,
linux-wireless@vger.kernel.org, netdev@vger.kernel.org,
pabeni@redhat.com, syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [wireless?] KMSAN: uninit-value in ieee80211_amsdu_to_8023s
Date: Sun, 03 Mar 2024 23:23:24 -0800 [thread overview]
Message-ID: <000000000000db848a0612d09997@google.com> (raw)
In-Reply-To: <000000000000b18c2406124b652e@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: 58c806d867bf Merge tag 'phy-fixes2-6.8' of git://git.kerne..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=12374c96180000
kernel config: https://syzkaller.appspot.com/x/.config?x=80c7a82a572c0de3
dashboard link: https://syzkaller.appspot.com/bug?extid=d050d437fe47d479d210
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14227612180000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=134411a2180000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/b2b0ed9886ae/disk-58c806d8.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/372dff1b6033/vmlinux-58c806d8.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d2b87ebe3e7b/bzImage-58c806d8.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d050d437fe47d479d210@syzkaller.appspotmail.com
=====================================================
BUG: KMSAN: uninit-value in ieee80211_amsdu_to_8023s+0x8c1/0x2d40 net/wireless/util.c:856
ieee80211_amsdu_to_8023s+0x8c1/0x2d40 net/wireless/util.c:856
__ieee80211_rx_h_amsdu+0x91a/0x13b0 net/mac80211/rx.c:3047
ieee80211_rx_h_amsdu net/mac80211/rx.c:3133 [inline]
ieee80211_rx_handlers+0x571a/0x10c40 net/mac80211/rx.c:4141
ieee80211_invoke_rx_handlers net/mac80211/rx.c:4185 [inline]
ieee80211_prepare_and_rx_handle+0x5640/0x9690 net/mac80211/rx.c:5033
__ieee80211_rx_handle_packet net/mac80211/rx.c:5239 [inline]
ieee80211_rx_list+0x642c/0x65d0 net/mac80211/rx.c:5410
ieee80211_rx_napi+0x84/0x3e0 net/mac80211/rx.c:5433
ieee80211_rx include/net/mac80211.h:4983 [inline]
ieee80211_tasklet_handler+0x19f/0x330 net/mac80211/main.c:318
tasklet_action_common+0x391/0xd30 kernel/softirq.c:780
tasklet_action+0x26/0x30 kernel/softirq.c:805
__do_softirq+0x1b7/0x7c5 kernel/softirq.c:553
run_ksoftirqd+0x24/0x40 kernel/softirq.c:921
smpboot_thread_fn+0x558/0xa60 kernel/smpboot.c:164
kthread+0x3ed/0x550 kernel/kthread.c:388
ret_from_fork+0x66/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:243
Local variable hdr created at:
ieee80211_amsdu_to_8023s+0x5b/0x2d40 net/wireless/util.c:832
__ieee80211_rx_h_amsdu+0x91a/0x13b0 net/mac80211/rx.c:3047
CPU: 0 PID: 15 Comm: ksoftirqd/0 Not tainted 6.8.0-rc6-syzkaller-00278-g58c806d867bf #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
=====================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
prev parent reply other threads:[~2024-03-04 7:23 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-02-26 16:28 [syzbot] [wireless?] KMSAN: uninit-value in ieee80211_amsdu_to_8023s syzbot
2024-03-04 7:23 ` syzbot [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000db848a0612d09997@google.com \
--to=syzbot+d050d437fe47d479d210@syzkaller.appspotmail.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=johannes.berg@intel.com \
--cc=johannes@sipsolutions.net \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).