From: syzbot <syzbot+dd514b5f0cf048aec256@syzkaller.appspotmail.com>
To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com,
xiaopei01@kylinos.cn
Subject: Re: [syzbot] [serial?] KMSAN: uninit-value in n_tty_receive_buf_closing (3)
Date: Thu, 25 Sep 2025 03:09:05 -0700 [thread overview]
Message-ID: <68d514c1.050a0220.25d7ab.0008.GAE@google.com> (raw)
In-Reply-To: <905bb5a8bc3e969ef332dd604864ba67b93e1a85.1758789532.git.xiaopei01@kylinos.cn>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: use-after-free in n_tty_receive_buf_standard
=====================================================
BUG: KMSAN: use-after-free in n_tty_receive_char_special drivers/tty/n_tty.c:1347 [inline]
BUG: KMSAN: use-after-free in n_tty_receive_buf_standard+0x1283/0x98a0 drivers/tty/n_tty.c:1588
n_tty_receive_char_special drivers/tty/n_tty.c:1347 [inline]
n_tty_receive_buf_standard+0x1283/0x98a0 drivers/tty/n_tty.c:1588
__receive_buf drivers/tty/n_tty.c:1624 [inline]
n_tty_receive_buf_common+0x198b/0x2470 drivers/tty/n_tty.c:1723
n_tty_receive_buf2+0x4c/0x60 drivers/tty/n_tty.c:1769
tty_ldisc_receive_buf+0xc3/0x2c0 drivers/tty/tty_buffer.c:388
tty_port_default_receive_buf+0xd7/0x1a0 drivers/tty/tty_port.c:37
receive_buf drivers/tty/tty_buffer.c:446 [inline]
flush_to_ldisc+0x43e/0xe30 drivers/tty/tty_buffer.c:496
process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xa2d/0x1b80 kernel/workqueue.c:3319
worker_thread+0xedf/0x1590 kernel/workqueue.c:3400
kthread+0xd5c/0xf00 kernel/kthread.c:463
ret_from_fork+0x230/0x380 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Uninit was created at:
slab_free_hook mm/slub.c:2348 [inline]
slab_free mm/slub.c:4695 [inline]
kfree+0x252/0xec0 mm/slub.c:4894
ieee80211_ibss_rx_queued_mgmt+0x2eea/0x3e80 net/mac80211/ibss.c:-1
ieee80211_iface_process_skb net/mac80211/iface.c:1699 [inline]
ieee80211_iface_work+0x11c7/0x1e70 net/mac80211/iface.c:1753
cfg80211_wiphy_work+0x341/0x850 net/wireless/core.c:435
process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xa2d/0x1b80 kernel/workqueue.c:3319
worker_thread+0xedf/0x1590 kernel/workqueue.c:3400
kthread+0xd5c/0xf00 kernel/kthread.c:463
ret_from_fork+0x230/0x380 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
CPU: 0 UID: 0 PID: 3884 Comm: kworker/u8:21 Not tainted syzkaller #0 PREEMPT(none)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Workqueue: events_unbound flush_to_ldisc
=====================================================
Tested on:
commit: bf40f4b8 Merge tag 'probes-fixes-v6.17-rc7' of git://g..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17a134e2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f7564f7873be81d2
dashboard link: https://syzkaller.appspot.com/bug?extid=dd514b5f0cf048aec256
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=173a34e2580000
next prev parent reply other threads:[~2025-09-25 10:09 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20250925062317.1281522-1-kartikey406@gmail.com>
2025-09-25 7:02 ` [syzbot] [fs?] [mm?] WARNING: bad unlock balance in hugetlb_vmdelete_list syzbot
2025-09-25 8:41 ` [PATCH] KMSAN: uninit-value in n_tty_receive_buf_closing Pei Xiao
2025-09-25 8:47 ` Pei Xiao
2025-09-25 8:52 ` Pei Xiao
2025-09-25 9:05 ` [syzbot] [fs?] [mm?] WARNING: bad unlock balance in hugetlb_vmdelete_list syzbot
2025-09-25 10:09 ` syzbot [this message]
[not found] <CABPJ0viXDF2o1MjbsUBC=0aaBx+CxArAr5rkt961TrVibqLLPQ@mail.gmail.com>
2025-09-25 6:37 ` [syzbot] [serial?] KMSAN: uninit-value in n_tty_receive_buf_closing (3) syzbot
2024-08-19 13:42 syzbot
2024-12-27 18:44 ` syzbot
2025-09-25 5:40 ` Forwarded: " syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=68d514c1.050a0220.25d7ab.0008.GAE@google.com \
--to=syzbot+dd514b5f0cf048aec256@syzkaller.appspotmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=xiaopei01@kylinos.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox