syzbot


KMSAN: uninit-value in lec_atm_send

Status: upstream: reported C repro on 2025/11/28 11:59
Subsystems: net
[Documentation on labels]
Reported-by: syzbot+5dd615f890ddada54057@syzkaller.appspotmail.com
First crash: 172d, last: 31d
Discussions (5)
Title Replies (including bot) Last reply
[PATCH net v3] net: atm: implement pre_send to check input before sending 6 (6) 2025/12/11 10:30
[PATCH v3] net: atm: lec: add pre_send validation to avoid uninitialized 2 (2) 2025/12/10 10:28
[PATCH] net: atm: lec: add pre_send validation to avoid uninitialized 5 (5) 2025/12/08 19:11
[syzbot] [net?] KMSAN: uninit-value in lec_atm_send 0 (2) 2025/12/07 03:29
[PATCH] net: atm: targetless need more input msg 6 (6) 2025/12/04 10:35
Last patch testing requests (5)
Created Duration User Patch Repo Result
2026/05/10 21:19 35m retest repro upstream OK log
2026/03/01 20:10 20m retest repro upstream report log
2026/03/01 19:52 19m retest repro upstream report log
2025/12/11 10:50 23m retest repro upstream report log
2025/12/07 03:29 32m dharanitharan725@gmail.com patch upstream OK log

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in lec_atm_send+0x28bf/0x55a0 net/atm/lec.c:417
 lec_atm_send+0x28bf/0x55a0 net/atm/lec.c:417
 vcc_sendmsg+0x104e/0x11b0 net/atm/common.c:650
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg net/socket.c:742 [inline]
 ____sys_sendmsg+0xf37/0xfd0 net/socket.c:2592
 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2646
 __sys_sendmsg net/socket.c:2678 [inline]
 __do_sys_sendmsg net/socket.c:2683 [inline]
 __se_sys_sendmsg net/socket.c:2681 [inline]
 __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2681
 x64_sys_call+0x1e20/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:47
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x134/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
 lec_atm_send+0x28b8/0x55a0 net/atm/lec.c:417
 vcc_sendmsg+0x104e/0x11b0 net/atm/common.c:650
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg net/socket.c:742 [inline]
 ____sys_sendmsg+0xf37/0xfd0 net/socket.c:2592
 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2646
 __sys_sendmsg net/socket.c:2678 [inline]
 __do_sys_sendmsg net/socket.c:2683 [inline]
 __se_sys_sendmsg net/socket.c:2681 [inline]
 __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2681
 x64_sys_call+0x1e20/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:47
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x134/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
 slab_post_alloc_hook mm/slub.c:4545 [inline]
 slab_alloc_node mm/slub.c:4866 [inline]
 kmem_cache_alloc_node_noprof+0x3cd/0x12d0 mm/slub.c:4918
 kmalloc_reserve net/core/skbuff.c:613 [inline]
 __alloc_skb+0x855/0x1190 net/core/skbuff.c:713
 alloc_skb include/linux/skbuff.h:1383 [inline]
 vcc_sendmsg+0x601/0x11b0 net/atm/common.c:628
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg net/socket.c:742 [inline]
 ____sys_sendmsg+0xf37/0xfd0 net/socket.c:2592
 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2646
 __sys_sendmsg net/socket.c:2678 [inline]
 __do_sys_sendmsg net/socket.c:2683 [inline]
 __se_sys_sendmsg net/socket.c:2681 [inline]
 __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2681
 x64_sys_call+0x1e20/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:47
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x134/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 0 UID: 0 PID: 18186 Comm: syz.9.2051 Tainted: G        W           syzkaller #0 PREEMPT(full) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
=====================================================

Crashes (11):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/03/16 04:24 upstream f338e7738378 ee8d34d6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in lec_atm_send
2026/02/15 18:42 upstream ca4ee40bf13d 1e62d198 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in lec_atm_send
2026/02/14 16:04 upstream 770aaedb461a 1e62d198 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in lec_atm_send
2026/02/14 16:04 upstream 770aaedb461a 1e62d198 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in lec_atm_send
2025/11/25 21:35 upstream 8a2bcda5e139 64219f15 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in lec_atm_send
2025/11/24 21:05 upstream ac3fd01e4c1e bf6fe8fe .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in lec_atm_send
2025/11/24 11:55 upstream ac3fd01e4c1e 4fb8ef37 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in lec_atm_send
2026/04/14 09:40 upstream 0f0013213293 1a086e7c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in lec_atm_send
2025/11/27 09:27 upstream 4941a17751c9 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in lec_atm_send
2025/11/27 09:19 upstream 4941a17751c9 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in lec_atm_send
2025/11/27 09:16 upstream 4941a17751c9 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in lec_atm_send
* Struck through repros no longer work on HEAD.