* [syzbot] [mptcp?] KMSAN: uninit-value in mptcp_established_options
@ 2026-05-01 6:15 syzbot
2026-05-03 13:01 ` syzbot
0 siblings, 1 reply; 7+ messages in thread
From: syzbot @ 2026-05-01 6:15 UTC (permalink / raw)
To: davem, edumazet, geliang, horms, kuba, linux-kernel, martineau,
matttbe, mptcp, netdev, pabeni, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 08d0d3466664 Merge tag 'net-7.1-rc2' of git://git.kernel.o..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15f6976c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=1c3f61154f3bb7e5
dashboard link: https://syzkaller.appspot.com/bug?extid=ff020673c5e3d94d9478
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
userspace arch: i386
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8688db3eb9ae/disk-08d0d346.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/72c570681077/vmlinux-08d0d346.xz
kernel image: https://storage.googleapis.com/syzbot-assets/21669c9bddcd/bzImage-08d0d346.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ff020673c5e3d94d9478@syzkaller.appspotmail.com
=====================================================
BUG: KMSAN: uninit-value in mptcp_write_data_fin net/mptcp/options.c:542 [inline]
BUG: KMSAN: uninit-value in mptcp_established_options_dss net/mptcp/options.c:590 [inline]
BUG: KMSAN: uninit-value in mptcp_established_options+0x112f/0x3530 net/mptcp/options.c:874
mptcp_write_data_fin net/mptcp/options.c:542 [inline]
mptcp_established_options_dss net/mptcp/options.c:590 [inline]
mptcp_established_options+0x112f/0x3530 net/mptcp/options.c:874
tcp_established_options+0x312/0xcc0 net/ipv4/tcp_output.c:1192
__tcp_transmit_skb+0x5dc/0x5fe0 net/ipv4/tcp_output.c:1575
__tcp_send_ack+0x967/0xad0 net/ipv4/tcp_output.c:4499
tcp_send_ack+0x3d/0x60 net/ipv4/tcp_output.c:4505
mptcp_subflow_shutdown+0x164/0x690 net/mptcp/protocol.c:3137
mptcp_check_send_data_fin+0x31b/0x3d0 net/mptcp/protocol.c:3218
__mptcp_wr_shutdown net/mptcp/protocol.c:3234 [inline]
__mptcp_close+0x860/0x1360 net/mptcp/protocol.c:3313
mptcp_close+0x42/0x260 net/mptcp/protocol.c:3367
inet_release+0x1ee/0x2a0 net/ipv4/af_inet.c:442
__sock_release net/socket.c:722 [inline]
sock_close+0xd6/0x2f0 net/socket.c:1514
__fput+0x60e/0x1010 fs/file_table.c:510
____fput+0x25/0x30 fs/file_table.c:538
task_work_run+0x208/0x2b0 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
exit_to_user_mode_loop+0x306/0x1b60 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
__do_fast_syscall_32+0x2c7/0x460 arch/x86/entry/syscall_32.c:310
do_fast_syscall_32+0x37/0x80 arch/x86/entry/syscall_32.c:332
do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:370
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
Local variable opts created at:
__tcp_transmit_skb+0x4d/0x5fe0 net/ipv4/tcp_output.c:1536
__tcp_send_ack+0x967/0xad0 net/ipv4/tcp_output.c:4499
CPU: 0 UID: 0 PID: 24584 Comm: syz.4.6812 Tainted: G W syzkaller #0 PREEMPT(full)
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
=====================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [syzbot] [mptcp?] KMSAN: uninit-value in mptcp_established_options
2026-05-01 6:15 syzbot
@ 2026-05-03 13:01 ` syzbot
0 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2026-05-03 13:01 UTC (permalink / raw)
To: davem, edumazet, geliang, horms, kmta1236, kuba, kuni1840, kuniyu,
linux-kernel, martineau, matttbe, mptcp, netdev, pabeni,
syzkaller-bugs
syzbot has found a reproducer for the following issue on:
HEAD commit: 66edb901bf87 Merge tag 'v7.1-p3' of git://git.kernel.org/p..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1086da36580000
kernel config: https://syzkaller.appspot.com/x/.config?x=1c3f61154f3bb7e5
dashboard link: https://syzkaller.appspot.com/bug?extid=ff020673c5e3d94d9478
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1260fece580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/9014c04fc561/disk-66edb901.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a96b1e11a924/vmlinux-66edb901.xz
kernel image: https://storage.googleapis.com/syzbot-assets/680236de6331/bzImage-66edb901.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ff020673c5e3d94d9478@syzkaller.appspotmail.com
=====================================================
BUG: KMSAN: uninit-value in mptcp_write_data_fin net/mptcp/options.c:542 [inline]
BUG: KMSAN: uninit-value in mptcp_established_options_dss net/mptcp/options.c:590 [inline]
BUG: KMSAN: uninit-value in mptcp_established_options+0x112f/0x3530 net/mptcp/options.c:874
mptcp_write_data_fin net/mptcp/options.c:542 [inline]
mptcp_established_options_dss net/mptcp/options.c:590 [inline]
mptcp_established_options+0x112f/0x3530 net/mptcp/options.c:874
tcp_established_options+0x312/0xcc0 net/ipv4/tcp_output.c:1192
__tcp_transmit_skb+0x5dc/0x5fe0 net/ipv4/tcp_output.c:1575
__tcp_send_ack+0x967/0xad0 net/ipv4/tcp_output.c:4499
tcp_send_ack+0x3d/0x60 net/ipv4/tcp_output.c:4505
mptcp_subflow_shutdown+0x164/0x690 net/mptcp/protocol.c:3137
mptcp_check_send_data_fin+0x31b/0x3d0 net/mptcp/protocol.c:3218
__mptcp_wr_shutdown net/mptcp/protocol.c:3234 [inline]
__mptcp_close+0x860/0x1360 net/mptcp/protocol.c:3313
mptcp_close+0x42/0x260 net/mptcp/protocol.c:3367
inet_release+0x1ee/0x2a0 net/ipv4/af_inet.c:442
__sock_release net/socket.c:722 [inline]
sock_close+0xd6/0x2f0 net/socket.c:1514
__fput+0x60e/0x1010 fs/file_table.c:510
____fput+0x25/0x30 fs/file_table.c:538
task_work_run+0x208/0x2b0 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
exit_to_user_mode_loop+0x306/0x1b60 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
do_syscall_64+0x236/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Local variable opts created at:
__tcp_transmit_skb+0x4d/0x5fe0 net/ipv4/tcp_output.c:1536
__tcp_send_ack+0x967/0xad0 net/ipv4/tcp_output.c:4499
CPU: 0 UID: 0 PID: 5905 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
=====================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [syzbot] [mptcp?] KMSAN: uninit-value in mptcp_established_options
[not found] <20260503145319.7726-1-kartikey406@gmail.com>
@ 2026-05-03 15:47 ` syzbot
0 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2026-05-03 15:47 UTC (permalink / raw)
To: kartikey406, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: uninit-value in mptcp_write_options
=====================================================
BUG: KMSAN: uninit-value in mptcp_write_options+0x410/0x32e0 net/mptcp/options.c:1462
mptcp_write_options+0x410/0x32e0 net/mptcp/options.c:1462
mptcp_options_write net/ipv4/tcp_output.c:457 [inline]
tcp_options_write+0x1399/0x1920 net/ipv4/tcp_output.c:833
__tcp_transmit_skb+0x36fe/0x5fe0 net/ipv4/tcp_output.c:1656
__tcp_send_ack+0x967/0xad0 net/ipv4/tcp_output.c:4499
tcp_send_ack+0x3d/0x60 net/ipv4/tcp_output.c:4505
__mptcp_subflow_send_ack net/mptcp/protocol.c:538 [inline]
mptcp_subflow_send_ack net/mptcp/protocol.c:546 [inline]
mptcp_send_ack net/mptcp/protocol.c:555 [inline]
mptcp_check_data_fin+0xa61/0xf00 net/mptcp/protocol.c:643
mptcp_worker+0xde4/0x1ea0 net/mptcp/protocol.c:2980
process_one_work kernel/workqueue.c:3302 [inline]
process_scheduled_works+0xb65/0x1e40 kernel/workqueue.c:3385
worker_thread+0xee4/0x1590 kernel/workqueue.c:3466
kthread+0x53f/0x600 kernel/kthread.c:436
ret_from_fork+0x20f/0x8d0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Uninit was stored to memory at:
mptcp_established_options_dss net/mptcp/options.c:616 [inline]
mptcp_established_options+0x2270/0x3590 net/mptcp/options.c:876
tcp_established_options+0x312/0xcc0 net/ipv4/tcp_output.c:1192
__tcp_transmit_skb+0x5dc/0x5fe0 net/ipv4/tcp_output.c:1575
__tcp_send_ack+0x967/0xad0 net/ipv4/tcp_output.c:4499
tcp_send_ack+0x3d/0x60 net/ipv4/tcp_output.c:4505
__mptcp_subflow_send_ack net/mptcp/protocol.c:538 [inline]
mptcp_subflow_send_ack net/mptcp/protocol.c:546 [inline]
mptcp_send_ack net/mptcp/protocol.c:555 [inline]
mptcp_check_data_fin+0xa61/0xf00 net/mptcp/protocol.c:643
mptcp_worker+0xde4/0x1ea0 net/mptcp/protocol.c:2980
process_one_work kernel/workqueue.c:3302 [inline]
process_scheduled_works+0xb65/0x1e40 kernel/workqueue.c:3385
worker_thread+0xee4/0x1590 kernel/workqueue.c:3466
kthread+0x53f/0x600 kernel/kthread.c:436
ret_from_fork+0x20f/0x8d0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Local variable opts created at:
__tcp_transmit_skb+0x4d/0x5fe0 net/ipv4/tcp_output.c:1536
__tcp_send_ack+0x967/0xad0 net/ipv4/tcp_output.c:4499
CPU: 1 UID: 0 PID: 37 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Workqueue: events mptcp_worker
=====================================================
Tested on:
commit: 66edb901 Merge tag 'v7.1-p3' of git://git.kernel.org/p..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12f8fece580000
kernel config: https://syzkaller.appspot.com/x/.config?x=1c3f61154f3bb7e5
dashboard link: https://syzkaller.appspot.com/bug?extid=ff020673c5e3d94d9478
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=1668fece580000
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [syzbot] [mptcp?] KMSAN: uninit-value in mptcp_established_options
[not found] <20260503232040.9451-1-kartikey406@gmail.com>
@ 2026-05-04 0:08 ` syzbot
0 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2026-05-04 0:08 UTC (permalink / raw)
To: kartikey406, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: uninit-value in irqentry_exit_to_kernel_mode_preempt
=====================================================
BUG: KMSAN: uninit-value in irqentry_exit_to_kernel_mode_preempt+0xb0/0xc0 include/linux/irq-entry-common.h:472
irqentry_exit_to_kernel_mode_preempt+0xb0/0xc0 include/linux/irq-entry-common.h:472
irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:547 [inline]
irqentry_exit+0x7b/0x760 kernel/entry/common.c:164
sysvec_apic_timer_interrupt+0x52/0x90 arch/x86/kernel/apic/apic.c:1061
asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:697
kmsan_get_shadow_origin_ptr+0xa/0xb0 mm/kmsan/shadow.c:83
get_shadow_origin_ptr mm/kmsan/instrumentation.c:38 [inline]
__msan_metadata_ptr_for_load_4+0x24/0x40 mm/kmsan/instrumentation.c:93
tcp_data_queue+0xdc/0x7c90 net/ipv4/tcp_input.c:5589
tcp_rcv_established+0x19bb/0x3200 net/ipv4/tcp_input.c:6656
tcp_v4_do_rcv+0xc4b/0x1b10 net/ipv4/tcp_ipv4.c:1852
sk_backlog_rcv include/net/sock.h:1190 [inline]
__release_sock+0x360/0x7d0 net/core/sock.c:3216
release_sock+0x22d/0x300 net/core/sock.c:3815
mptcp_subflow_shutdown+0x358/0x690 net/mptcp/protocol.c:3144
mptcp_check_send_data_fin+0x31b/0x3d0 net/mptcp/protocol.c:3218
__mptcp_wr_shutdown net/mptcp/protocol.c:3234 [inline]
__mptcp_close+0x860/0x1360 net/mptcp/protocol.c:3313
mptcp_close+0x42/0x260 net/mptcp/protocol.c:3367
inet_release+0x1ee/0x2a0 net/ipv4/af_inet.c:442
__sock_release net/socket.c:722 [inline]
sock_close+0xd6/0x2f0 net/socket.c:1514
__fput+0x60e/0x1010 fs/file_table.c:510
____fput+0x25/0x30 fs/file_table.c:538
task_work_run+0x208/0x2b0 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
exit_to_user_mode_loop+0x306/0x1b60 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
do_syscall_64+0x236/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Local variable mp_opt created at:
mptcp_incoming_options+0x11d/0x43b0 net/mptcp/options.c:1168
tcp_data_queue+0x80/0x7c90 net/ipv4/tcp_input.c:5584
CPU: 0 UID: 0 PID: 6814 Comm: syz.0.164 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
=====================================================
Tested on:
commit: 6d35786d Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1763da36580000
kernel config: https://syzkaller.appspot.com/x/.config?x=1c3f61154f3bb7e5
dashboard link: https://syzkaller.appspot.com/bug?extid=ff020673c5e3d94d9478
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=135afece580000
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [syzbot] [mptcp?] KMSAN: uninit-value in mptcp_established_options
2026-05-04 9:59 [PATCH] mptcp: fix " Matthieu Baerts
@ 2026-05-04 11:14 ` syzbot
0 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2026-05-04 11:14 UTC (permalink / raw)
To: kuniyu, linux-kernel, matttbe, mptcp, pabeni, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: uninit-value in mptcp_write_options
=====================================================
BUG: KMSAN: uninit-value in mptcp_write_options+0x410/0x32e0 net/mptcp/options.c:1462
mptcp_write_options+0x410/0x32e0 net/mptcp/options.c:1462
mptcp_options_write net/ipv4/tcp_output.c:457 [inline]
tcp_options_write+0x1399/0x1920 net/ipv4/tcp_output.c:833
__tcp_transmit_skb+0x36fe/0x5fe0 net/ipv4/tcp_output.c:1656
__tcp_send_ack+0x967/0xad0 net/ipv4/tcp_output.c:4499
tcp_send_ack+0x3d/0x60 net/ipv4/tcp_output.c:4505
__mptcp_subflow_send_ack net/mptcp/protocol.c:538 [inline]
mptcp_subflow_send_ack net/mptcp/protocol.c:546 [inline]
mptcp_send_ack net/mptcp/protocol.c:555 [inline]
mptcp_check_data_fin+0xa61/0xf00 net/mptcp/protocol.c:643
mptcp_worker+0xde4/0x1ea0 net/mptcp/protocol.c:2980
process_one_work kernel/workqueue.c:3302 [inline]
process_scheduled_works+0xb65/0x1e40 kernel/workqueue.c:3385
worker_thread+0xee4/0x1590 kernel/workqueue.c:3466
kthread+0x53f/0x600 kernel/kthread.c:436
ret_from_fork+0x20f/0x8d0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Uninit was stored to memory at:
mptcp_established_options_dss net/mptcp/options.c:616 [inline]
mptcp_established_options+0x2265/0x3580 net/mptcp/options.c:876
tcp_established_options+0x312/0xcc0 net/ipv4/tcp_output.c:1192
__tcp_transmit_skb+0x5dc/0x5fe0 net/ipv4/tcp_output.c:1575
__tcp_send_ack+0x967/0xad0 net/ipv4/tcp_output.c:4499
tcp_send_ack+0x3d/0x60 net/ipv4/tcp_output.c:4505
__mptcp_subflow_send_ack net/mptcp/protocol.c:538 [inline]
mptcp_subflow_send_ack net/mptcp/protocol.c:546 [inline]
mptcp_send_ack net/mptcp/protocol.c:555 [inline]
mptcp_check_data_fin+0xa61/0xf00 net/mptcp/protocol.c:643
mptcp_worker+0xde4/0x1ea0 net/mptcp/protocol.c:2980
process_one_work kernel/workqueue.c:3302 [inline]
process_scheduled_works+0xb65/0x1e40 kernel/workqueue.c:3385
worker_thread+0xee4/0x1590 kernel/workqueue.c:3466
kthread+0x53f/0x600 kernel/kthread.c:436
ret_from_fork+0x20f/0x8d0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Local variable opts created at:
__tcp_transmit_skb+0x4d/0x5fe0 net/ipv4/tcp_output.c:1536
__tcp_send_ack+0x967/0xad0 net/ipv4/tcp_output.c:4499
CPU: 0 UID: 0 PID: 4890 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Workqueue: events mptcp_worker
=====================================================
Tested on:
commit: 6d35786d Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=123d6696580000
kernel config: https://syzkaller.appspot.com/x/.config?x=1c3f61154f3bb7e5
dashboard link: https://syzkaller.appspot.com/bug?extid=ff020673c5e3d94d9478
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=1663f21f980000
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [syzbot] [mptcp?] KMSAN: uninit-value in mptcp_established_options
2026-05-04 16:22 [PATCH] mptcp: fix " Paolo Abeni
@ 2026-05-04 17:14 ` syzbot
0 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2026-05-04 17:14 UTC (permalink / raw)
To: kuniyu, linux-kernel, matttbe, mptcp, pabeni, syzkaller-bugs
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
failed to apply patch:
checking file include/net/mptcp.h
checking file net/mptcp/options.c
patch: **** unexpected end of file in patch
Tested on:
commit: 6d35786d Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=1c3f61154f3bb7e5
dashboard link: https://syzkaller.appspot.com/bug?extid=ff020673c5e3d94d9478
compiler:
patch: https://syzkaller.appspot.com/x/patch.diff?x=12558ad2580000
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [syzbot] [mptcp?] KMSAN: uninit-value in mptcp_established_options
2026-05-04 17:31 [PATCH] mptcp: fix " Paolo Abeni
@ 2026-05-04 18:20 ` syzbot
0 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2026-05-04 18:20 UTC (permalink / raw)
To: kuniyu, linux-kernel, matttbe, mptcp, pabeni, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: uninit-value in irqentry_exit_to_kernel_mode_preempt
=====================================================
BUG: KMSAN: uninit-value in irqentry_exit_to_kernel_mode_preempt+0xb0/0xc0 include/linux/irq-entry-common.h:472
irqentry_exit_to_kernel_mode_preempt+0xb0/0xc0 include/linux/irq-entry-common.h:472
irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:547 [inline]
irqentry_exit+0x7b/0x760 kernel/entry/common.c:164
sysvec_apic_timer_interrupt+0x52/0x90 arch/x86/kernel/apic/apic.c:1061
asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:697
kmsan_get_metadata+0x17/0x160 mm/kmsan/shadow.c:125
kmsan_get_shadow_origin_ptr+0x4a/0xb0 mm/kmsan/shadow.c:102
get_shadow_origin_ptr mm/kmsan/instrumentation.c:38 [inline]
__msan_metadata_ptr_for_load_4+0x24/0x40 mm/kmsan/instrumentation.c:93
tcp_data_queue+0xdc/0x7c90 net/ipv4/tcp_input.c:5589
tcp_rcv_established+0x19bb/0x3200 net/ipv4/tcp_input.c:6656
tcp_v4_do_rcv+0xc4b/0x1b10 net/ipv4/tcp_ipv4.c:1852
sk_backlog_rcv include/net/sock.h:1190 [inline]
__release_sock+0x360/0x7d0 net/core/sock.c:3216
release_sock+0x22d/0x300 net/core/sock.c:3815
mptcp_subflow_shutdown+0x358/0x690 net/mptcp/protocol.c:3144
mptcp_check_send_data_fin+0x31b/0x3d0 net/mptcp/protocol.c:3218
__mptcp_wr_shutdown net/mptcp/protocol.c:3234 [inline]
__mptcp_close+0x860/0x1360 net/mptcp/protocol.c:3313
mptcp_close+0x42/0x260 net/mptcp/protocol.c:3367
inet_release+0x1ee/0x2a0 net/ipv4/af_inet.c:442
__sock_release net/socket.c:722 [inline]
sock_close+0xd6/0x2f0 net/socket.c:1514
__fput+0x60e/0x1010 fs/file_table.c:510
____fput+0x25/0x30 fs/file_table.c:538
task_work_run+0x208/0x2b0 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
exit_to_user_mode_loop+0x306/0x1b60 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
do_syscall_64+0x236/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Local variable mp_opt created at:
mptcp_incoming_options+0x11d/0x43b0 net/mptcp/options.c:1171
tcp_data_queue+0x80/0x7c90 net/ipv4/tcp_input.c:5584
CPU: 1 UID: 0 PID: 8009 Comm: syz.0.635 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
=====================================================
Tested on:
commit: 6d35786d Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=10070d06580000
kernel config: https://syzkaller.appspot.com/x/.config?x=1c3f61154f3bb7e5
dashboard link: https://syzkaller.appspot.com/bug?extid=ff020673c5e3d94d9478
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=13d0b96a580000
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2026-05-04 18:20 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20260503145319.7726-1-kartikey406@gmail.com>
2026-05-03 15:47 ` [syzbot] [mptcp?] KMSAN: uninit-value in mptcp_established_options syzbot
2026-05-04 17:31 [PATCH] mptcp: fix " Paolo Abeni
2026-05-04 18:20 ` [syzbot] [mptcp?] " syzbot
-- strict thread matches above, loose matches on Subject: below --
2026-05-04 16:22 [PATCH] mptcp: fix " Paolo Abeni
2026-05-04 17:14 ` [syzbot] [mptcp?] " syzbot
2026-05-04 9:59 [PATCH] mptcp: fix " Matthieu Baerts
2026-05-04 11:14 ` [syzbot] [mptcp?] " syzbot
[not found] <20260503232040.9451-1-kartikey406@gmail.com>
2026-05-04 0:08 ` syzbot
2026-05-01 6:15 syzbot
2026-05-03 13:01 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox