KMSAN: uninit-value in tipc_nl_compat_bearer_disable

Status: fixed on 2019/07/29 13:39
Subsystems: tipc
[Documentation on labels]
Reported-by: syzbot+30eaa8bf392f7fafffaf@syzkaller.appspotmail.com
Fix commit: 4f07b80c9733 tipc: check msg->req data len in tipc_nl_compat_bearer_disable
First crash: 2604d, last: 2578d
▶ ▼ Discussions (8)
Title Replies (including bot) Last reply
[PATCH 4.14 00/43] 4.14.132-stable review 57 (57) 2019/08/03 07:11
[PATCH 4.9 000/102] 4.9.185-stable review 108 (108) 2019/07/10 06:11
[PATCH 4.4 00/73] 4.4.185-stable review 79 (79) 2019/07/10 06:10
[PATCH 4.19 00/72] 4.19.57-stable review 84 (84) 2019/07/04 05:29
[PATCH 5.1 00/55] 5.1.16-stable review 69 (69) 2019/07/04 05:27
[PATCHv2 net] tipc: check msg->req data len in tipc_nl_compat_bearer_disable 2 (2) 2019/06/24 17:04
[PATCH net] tipc: check msg->req data len in tipc_nl_compat_bearer_disable 4 (4) 2019/06/24 16:21
KMSAN: uninit-value in tipc_nl_compat_bearer_disable 1 (2) 2019/06/21 08:39

Sample crash report:
==================================================================
BUG: KMSAN: uninit-value in memchr+0xce/0x110 lib/string.c:1014
CPU: 0 PID: 13069 Comm: syz-executor525 Not tainted 5.2.0-rc4+ #7
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x191/0x1f0 lib/dump_stack.c:113
 kmsan_report+0x162/0x2d0 mm/kmsan/kmsan.c:611
 __msan_warning+0x75/0xe0 mm/kmsan/kmsan_instr.c:304
 memchr+0xce/0x110 lib/string.c:1014
 string_is_valid net/tipc/netlink_compat.c:176 [inline]
 tipc_nl_compat_bearer_disable+0x2a1/0x480 net/tipc/netlink_compat.c:449
 __tipc_nl_compat_doit net/tipc/netlink_compat.c:327 [inline]
 tipc_nl_compat_doit+0x3ac/0xb10 net/tipc/netlink_compat.c:360
 tipc_nl_compat_handle net/tipc/netlink_compat.c:1183 [inline]
 tipc_nl_compat_recv+0x13c6/0x27b0 net/tipc/netlink_compat.c:1286
 genl_family_rcv_msg net/netlink/genetlink.c:629 [inline]
 genl_rcv_msg+0x16c5/0x1f20 net/netlink/genetlink.c:654
 netlink_rcv_skb+0x431/0x620 net/netlink/af_netlink.c:2482
 genl_rcv+0x63/0x80 net/netlink/genetlink.c:665
 netlink_unicast_kernel net/netlink/af_netlink.c:1307 [inline]
 netlink_unicast+0xf3e/0x1020 net/netlink/af_netlink.c:1333
 netlink_sendmsg+0x127e/0x12f0 net/netlink/af_netlink.c:1922
 sock_sendmsg_nosec net/socket.c:646 [inline]
 sock_sendmsg net/socket.c:665 [inline]
 ___sys_sendmsg+0x12ff/0x13c0 net/socket.c:2286
 __sys_sendmsg net/socket.c:2324 [inline]
 __do_sys_sendmsg net/socket.c:2333 [inline]
 __se_sys_sendmsg+0x305/0x460 net/socket.c:2331
 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2331
 do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:302
 entry_SYSCALL_64_after_hwframe+0x63/0xe7
RIP: 0033:0x4411b9
Code: e8 fc ab 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 9b 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffd5cc4f0b8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004411b9
RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000003
RBP: 000000000001bb3b R08: 00000000004002c8 R09: 00000000004002c8
R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000401fe0
R13: 0000000000402070 R14: 0000000000000000 R15: 0000000000000000

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:201 [inline]
 kmsan_internal_poison_shadow+0x53/0xa0 mm/kmsan/kmsan.c:160
 kmsan_kmalloc+0xa4/0x130 mm/kmsan/kmsan_hooks.c:178
 kmsan_slab_alloc+0xe/0x10 mm/kmsan/kmsan_hooks.c:187
 slab_post_alloc_hook mm/slab.h:442 [inline]
 slab_alloc_node mm/slub.c:2763 [inline]
 __kmalloc_node_track_caller+0xcba/0xf30 mm/slub.c:4390
 __kmalloc_reserve net/core/skbuff.c:138 [inline]
 __alloc_skb+0x306/0xa10 net/core/skbuff.c:206
 alloc_skb include/linux/skbuff.h:1055 [inline]
 netlink_alloc_large_skb net/netlink/af_netlink.c:1179 [inline]
 netlink_sendmsg+0xb81/0x12f0 net/netlink/af_netlink.c:1897
 sock_sendmsg_nosec net/socket.c:646 [inline]
 sock_sendmsg net/socket.c:665 [inline]
 ___sys_sendmsg+0x12ff/0x13c0 net/socket.c:2286
 __sys_sendmsg net/socket.c:2324 [inline]
 __do_sys_sendmsg net/socket.c:2333 [inline]
 __se_sys_sendmsg+0x305/0x460 net/socket.c:2331
 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2331
 do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:302
 entry_SYSCALL_64_after_hwframe+0x63/0xe7
==================================================================

Crashes (19):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/07/02 22:28 https://github.com/google/kmsan.git master 41550654dedf 55565fa0 .config console log report syz C ci-upstream-kmsan-gce
2019/06/06 05:13 https://github.com/google/kmsan.git master f75e4cfea97f a547defc .config console log report syz C ci-upstream-kmsan-gce
2019/06/26 21:21 https://github.com/google/kmsan.git master 41550654dedf 7509bf36 .config console log report ci-upstream-kmsan-gce
2019/06/26 20:14 https://github.com/google/kmsan.git master 41550654dedf 7509bf36 .config console log report ci-upstream-kmsan-gce
2019/06/26 18:37 https://github.com/google/kmsan.git master 41550654dedf 7509bf36 .config console log report ci-upstream-kmsan-gce
2019/06/26 18:05 https://github.com/google/kmsan.git master 41550654dedf 7509bf36 .config console log report ci-upstream-kmsan-gce
2019/06/25 17:15 https://github.com/google/kmsan.git master 6e0b7ebbe9bc 0a8d1a96 .config console log report ci-upstream-kmsan-gce
2019/06/25 08:41 https://github.com/google/kmsan.git master 6e0b7ebbe9bc 82c13b6b .config console log report ci-upstream-kmsan-gce
2019/06/24 08:45 https://github.com/google/kmsan.git master 3351e2b9635b 472f0082 .config console log report ci-upstream-kmsan-gce
2019/06/20 14:59 https://github.com/google/kmsan.git master 3351e2b9635b 34bf9440 .config console log report ci-upstream-kmsan-gce
2019/06/19 02:52 https://github.com/google/kmsan.git master aad0f0dd72ab e3f76baa .config console log report ci-upstream-kmsan-gce
2019/06/15 06:12 https://github.com/google/kmsan.git master 14cf4e4151b0 442206d7 .config console log report ci-upstream-kmsan-gce
2019/06/14 07:46 https://github.com/google/kmsan.git master 62c1edc4b8ee 998ccc76 .config console log report ci-upstream-kmsan-gce
2019/06/13 09:34 https://github.com/google/kmsan.git master 62c1edc4b8ee 3f4e812b .config console log report ci-upstream-kmsan-gce
2019/06/11 22:23 https://github.com/google/kmsan.git master 62c1edc4b8ee ea2f4006 .config console log report ci-upstream-kmsan-gce
2019/06/11 17:03 https://github.com/google/kmsan.git master 62c1edc4b8ee 5b5826d0 .config console log report ci-upstream-kmsan-gce
2019/06/10 03:04 https://github.com/google/kmsan.git master 62c1edc4b8ee 0159583c .config console log report ci-upstream-kmsan-gce
2019/06/07 07:01 https://github.com/google/kmsan.git master f75e4cfea97f 698773cb .config console log report ci-upstream-kmsan-gce
2019/06/06 03:27 https://github.com/google/kmsan.git master f75e4cfea97f a547defc .config console log report ci-upstream-kmsan-gce
* Struck through repros no longer work on HEAD.