KMSAN: uninit-value in batadv_hard_if_event (2)

Status: fixed on 2020/11/16 12:12
Subsystems: batman usb
[Documentation on labels]
Reported-by: syzbot+abbc768b560c84d92fd3@syzkaller.appspotmail.com
Fix commit: f45a4248ea4c net: usb: rtl8150: set random MAC address when set_ethernet_addr() fails
First crash: 2192d, last: 2108d
▶ ▼ Discussions (19)
Title Replies (including bot) Last reply
Auto-invalidating old syzbot reports? 4 (4) 2022/06/13 15:47
[PATCH 5.8 000/124] 5.8.15-rc1 review 136 (136) 2020/10/14 18:31
[PATCH AUTOSEL 5.8 01/24] net: lantiq: Add locking for TX DMA channel 27 (27) 2020/10/14 14:04
[PATCH 4.4 00/39] 4.4.239-rc1 review 46 (46) 2020/10/14 10:18
[PATCH 4.19 00/49] 4.19.151-rc1 review 56 (56) 2020/10/14 08:34
[PATCH 4.9 00/54] 4.9.239-rc1 review 58 (58) 2020/10/14 01:39
[PATCH 4.14 00/70] 4.14.201-rc1 review 74 (74) 2020/10/14 01:28
[PATCH 5.4 00/85] 5.4.71-rc1 review 89 (89) 2020/10/14 01:24
[PATCH AUTOSEL 4.4 1/6] platform/x86: asus-nb-wmi: Revert "Do not load on Asus T100TA and T200TA" 6 (6) 2020/10/12 19:04
[PATCH AUTOSEL 4.9 1/6] platform/x86: asus-nb-wmi: Revert "Do not load on Asus T100TA and T200TA" 6 (6) 2020/10/12 19:04
[PATCH AUTOSEL 4.14 01/11] platform/x86: asus-nb-wmi: Revert "Do not load on Asus T100TA and T200TA" 11 (11) 2020/10/12 19:03
[PATCH AUTOSEL 4.19 01/12] platform/x86: asus-nb-wmi: Revert "Do not load on Asus T100TA and T200TA" 12 (12) 2020/10/12 19:03
[PATCH AUTOSEL 5.4 01/15] net: lantiq: Add locking for TX DMA channel 15 (15) 2020/10/12 19:03
[PATCH v4] net: usb: rtl8150: set random MAC address when set_ethernet_addr() fails 2 (2) 2020/10/06 13:10
[PATCH v3] net: usb: rtl8150: set random MAC address when set_ethernet_addr() fails 3 (3) 2020/10/03 21:45
[Linux-kernel-mentees][PATCH v2] net: usb: rtl8150: prevent set_ethernet_addr from setting uninit address 11 (11) 2020/10/03 20:58
[Linux-kernel-mentees][PATCH] net: usb: rtl8150: prevent set_ethernet_addr from setting uninit address 4 (4) 2020/09/30 04:02
[Linux-kernel-mentees][PATCH] rtl8150: set memory to all 0xFFs on failed register reads 6 (6) 2020/09/16 13:40
KMSAN: uninit-value in batadv_hard_if_event (2) 0 (2) 2020/08/13 09:31
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in batadv_hard_if_event batman 7 11 2476d 2487d 0/29 auto-closed as invalid on 2020/02/26 06:35
▶ ▼ Last patch testing requests (12)
Created Duration User Patch Repo Result
2020/10/04 10:55 21m anant.thazhemadam@gmail.com patch https://github.com/google/kmsan.git master OK
2020/10/02 21:59 29m anant.thazhemadam@gmail.com patch https://github.com/google/kmsan.git master OK
2020/09/29 06:31 21m anant.thazhemadam@gmail.com https://github.com/google/kmsan.git master OK
2020/09/29 06:06 22m anant.thazhemadam@gmail.com patch https://github.com/google/kmsan.git master OK
2020/09/29 03:49 6m anant.thazhemadam@gmail.com patch https://github.com/google/kmsan.git master error
2020/09/29 03:06 6m anant.thazhemadam@gmail.com patch https://github.com/google/kmsan.git master error
2020/09/28 22:33 21m anant.thazhemadam@gmail.com patch https://github.com/google/kmsan.git master OK
2020/09/16 06:54 21m anant.thazhemadam@gmail.com patch https://github.com/google/kmsan.git master OK
2020/09/15 19:12 14m anant.thazhemadam@gmail.com https://github.com/google/kmsan.git master report log
2020/09/15 14:45 21m anant.thazhemadam@gmail.com patch https://github.com/google/kmsan.git master OK
2020/09/03 22:06 5m anant.thazhemadam@gmail.com patch https://github.com/google/kmsan.git master error
2020/09/02 23:44 13m dragonjetli@gmail.com https://github.com/google/kmsan.git master report log

Sample crash report:
usb 1-1: new high-speed USB device number 2 using dummy_hcd
usb 1-1: New USB device found, idVendor=07b8, idProduct=401a, bcdDevice=3d.3d
usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
usb 1-1: config 0 descriptor??
=====================================================
BUG: KMSAN: uninit-value in batadv_check_known_mac_addr net/batman-adv/hard-interface.c:512 [inline]
BUG: KMSAN: uninit-value in batadv_hardif_add_interface net/batman-adv/hard-interface.c:944 [inline]
BUG: KMSAN: uninit-value in batadv_hard_if_event+0x28d7/0x3bd0 net/batman-adv/hard-interface.c:1034
CPU: 1 PID: 17 Comm: kworker/1:0 Not tainted 5.8.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: usb_hub_wq hub_event
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x21c/0x280 lib/dump_stack.c:118
 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:121
 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215
 batadv_check_known_mac_addr net/batman-adv/hard-interface.c:512 [inline]
 batadv_hardif_add_interface net/batman-adv/hard-interface.c:944 [inline]
 batadv_hard_if_event+0x28d7/0x3bd0 net/batman-adv/hard-interface.c:1034
 notifier_call_chain kernel/notifier.c:83 [inline]
 __raw_notifier_call_chain kernel/notifier.c:361 [inline]
 raw_notifier_call_chain+0x123/0x290 kernel/notifier.c:368
 call_netdevice_notifiers_info net/core/dev.c:2027 [inline]
 call_netdevice_notifiers_extack net/core/dev.c:2039 [inline]
 call_netdevice_notifiers net/core/dev.c:2053 [inline]
 register_netdevice+0x3120/0x37d0 net/core/dev.c:9545
 register_netdev+0xbe/0x100 net/core/dev.c:9645
 rtl8150_probe+0x12d9/0x15b0 drivers/net/usb/rtl8150.c:916
 usb_probe_interface+0xece/0x1550 drivers/usb/core/driver.c:374
 really_probe+0xf20/0x20b0 drivers/base/dd.c:529
 driver_probe_device+0x293/0x390 drivers/base/dd.c:701
 __device_attach_driver+0x63f/0x830 drivers/base/dd.c:807
 bus_for_each_drv+0x2ca/0x3f0 drivers/base/bus.c:431
 __device_attach+0x4e2/0x7f0 drivers/base/dd.c:873
 device_initial_probe+0x4a/0x60 drivers/base/dd.c:920
 bus_probe_device+0x177/0x3d0 drivers/base/bus.c:491
 device_add+0x3b0e/0x40d0 drivers/base/core.c:2680
 usb_set_configuration+0x380f/0x3f10 drivers/usb/core/message.c:2032
 usb_generic_driver_probe+0x138/0x300 drivers/usb/core/generic.c:241
 usb_probe_device+0x311/0x490 drivers/usb/core/driver.c:272
 really_probe+0xf20/0x20b0 drivers/base/dd.c:529
 driver_probe_device+0x293/0x390 drivers/base/dd.c:701
 __device_attach_driver+0x63f/0x830 drivers/base/dd.c:807
 bus_for_each_drv+0x2ca/0x3f0 drivers/base/bus.c:431
 __device_attach+0x4e2/0x7f0 drivers/base/dd.c:873
 device_initial_probe+0x4a/0x60 drivers/base/dd.c:920
 bus_probe_device+0x177/0x3d0 drivers/base/bus.c:491
 device_add+0x3b0e/0x40d0 drivers/base/core.c:2680
 usb_new_device+0x1bd4/0x2a30 drivers/usb/core/hub.c:2554
 hub_port_connect drivers/usb/core/hub.c:5208 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5348 [inline]
 port_event drivers/usb/core/hub.c:5494 [inline]
 hub_event+0x5e7b/0x8a70 drivers/usb/core/hub.c:5576
 process_one_work+0x1688/0x2140 kernel/workqueue.c:2269
 worker_thread+0x10bc/0x2730 kernel/workqueue.c:2415
 kthread+0x551/0x590 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293

Uninit was stored to memory at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:144 [inline]
 kmsan_internal_chain_origin+0xad/0x130 mm/kmsan/kmsan.c:310
 kmsan_memcpy_memmove_metadata+0x272/0x2e0 mm/kmsan/kmsan.c:247
 kmsan_memcpy_metadata+0xb/0x10 mm/kmsan/kmsan.c:267
 __msan_memcpy+0x43/0x50 mm/kmsan/kmsan_instr.c:116
 set_ethernet_addr drivers/net/usb/rtl8150.c:282 [inline]
 rtl8150_probe+0x1236/0x15b0 drivers/net/usb/rtl8150.c:912
 usb_probe_interface+0xece/0x1550 drivers/usb/core/driver.c:374
 really_probe+0xf20/0x20b0 drivers/base/dd.c:529
 driver_probe_device+0x293/0x390 drivers/base/dd.c:701
 __device_attach_driver+0x63f/0x830 drivers/base/dd.c:807
 bus_for_each_drv+0x2ca/0x3f0 drivers/base/bus.c:431
 __device_attach+0x4e2/0x7f0 drivers/base/dd.c:873
 device_initial_probe+0x4a/0x60 drivers/base/dd.c:920
 bus_probe_device+0x177/0x3d0 drivers/base/bus.c:491
 device_add+0x3b0e/0x40d0 drivers/base/core.c:2680
 usb_set_configuration+0x380f/0x3f10 drivers/usb/core/message.c:2032
 usb_generic_driver_probe+0x138/0x300 drivers/usb/core/generic.c:241
 usb_probe_device+0x311/0x490 drivers/usb/core/driver.c:272
 really_probe+0xf20/0x20b0 drivers/base/dd.c:529
 driver_probe_device+0x293/0x390 drivers/base/dd.c:701
 __device_attach_driver+0x63f/0x830 drivers/base/dd.c:807
 bus_for_each_drv+0x2ca/0x3f0 drivers/base/bus.c:431
 __device_attach+0x4e2/0x7f0 drivers/base/dd.c:873
 device_initial_probe+0x4a/0x60 drivers/base/dd.c:920
 bus_probe_device+0x177/0x3d0 drivers/base/bus.c:491
 device_add+0x3b0e/0x40d0 drivers/base/core.c:2680
 usb_new_device+0x1bd4/0x2a30 drivers/usb/core/hub.c:2554
 hub_port_connect drivers/usb/core/hub.c:5208 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5348 [inline]
 port_event drivers/usb/core/hub.c:5494 [inline]
 hub_event+0x5e7b/0x8a70 drivers/usb/core/hub.c:5576
 process_one_work+0x1688/0x2140 kernel/workqueue.c:2269
 worker_thread+0x10bc/0x2730 kernel/workqueue.c:2415
 kthread+0x551/0x590 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293

Local variable ----node_id.i@rtl8150_probe created at:
 get_registers drivers/net/usb/rtl8150.c:911 [inline]
 set_ethernet_addr drivers/net/usb/rtl8150.c:281 [inline]
 rtl8150_probe+0xea7/0x15b0 drivers/net/usb/rtl8150.c:912
 get_registers drivers/net/usb/rtl8150.c:911 [inline]
 set_ethernet_addr drivers/net/usb/rtl8150.c:281 [inline]
 rtl8150_probe+0xea7/0x15b0 drivers/net/usb/rtl8150.c:912
=====================================================

Crashes (162):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/08/20 20:08 https://github.com/google/kmsan.git master ce8056d1f79e ed282a3a .config console log report syz C ci-upstream-kmsan-gce
2020/08/13 09:30 https://github.com/google/kmsan.git master ce8056d1f79e bc15f7db .config console log report syz C ci-upstream-kmsan-gce
2020/10/15 18:37 https://github.com/google/kmsan.git master e67f4ba870c2 63869021 .config console log report info ci-upstream-kmsan-gce
2020/10/14 16:14 https://github.com/google/kmsan.git master e67f4ba870c2 fc7735a2 .config console log report info ci-upstream-kmsan-gce
2020/10/11 08:55 https://github.com/google/kmsan.git master e67f4ba870c2 4a77ae0b .config console log report info ci-upstream-kmsan-gce
2020/10/11 07:26 https://github.com/google/kmsan.git master e67f4ba870c2 4a77ae0b .config console log report info ci-upstream-kmsan-gce
2020/09/12 20:44 https://github.com/google/kmsan.git master 3b3ea6028136 ce441f06 .config console log report ci-upstream-kmsan-gce
2020/09/12 04:56 https://github.com/google/kmsan.git master 3b3ea6028136 79fb24e2 .config console log report ci-upstream-kmsan-gce
2020/09/11 15:11 https://github.com/google/kmsan.git master 3b3ea6028136 adfb8b4e .config console log report ci-upstream-kmsan-gce
2020/09/10 13:10 https://github.com/google/kmsan.git master 3b3ea6028136 409809d8 .config console log report ci-upstream-kmsan-gce
2020/09/09 20:47 https://github.com/google/kmsan.git master 3b3ea6028136 0ea7a887 .config console log report ci-upstream-kmsan-gce
2020/09/03 00:02 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce
2020/09/02 11:21 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce
2020/09/01 01:23 https://github.com/google/kmsan.git master 3b3ea6028136 d5a3ae1f .config console log report ci-upstream-kmsan-gce
2020/08/30 21:48 https://github.com/google/kmsan.git master 3b3ea6028136 d5a3ae1f .config console log report ci-upstream-kmsan-gce
2020/08/30 08:28 https://github.com/google/kmsan.git master 3b3ea6028136 d5a3ae1f .config console log report ci-upstream-kmsan-gce
2020/08/29 20:01 https://github.com/google/kmsan.git master 3b3ea6028136 d5a3ae1f .config console log report ci-upstream-kmsan-gce
2020/08/27 16:59 https://github.com/google/kmsan.git master ce8056d1f79e 816e0689 .config console log report ci-upstream-kmsan-gce
2020/08/26 22:32 https://github.com/google/kmsan.git master ce8056d1f79e 318430cb .config console log report ci-upstream-kmsan-gce
2020/10/31 11:10 https://github.com/google/kmsan.git master e16174226146 18e33098 .config console log report info ci-upstream-kmsan-gce-386
2020/10/30 20:35 https://github.com/google/kmsan.git master e16174226146 a6e3ac3b .config console log report info ci-upstream-kmsan-gce-386
2020/10/29 07:50 https://github.com/google/kmsan.git master e16174226146 f24824d3 .config console log report info ci-upstream-kmsan-gce-386
2020/10/26 09:24 https://github.com/google/kmsan.git master e16174226146 a1839e81 .config console log report info ci-upstream-kmsan-gce-386
2020/10/19 19:49 https://github.com/google/kmsan.git master e67f4ba870c2 ff4a3345 .config console log report info ci-upstream-kmsan-gce-386
2020/10/16 18:49 https://github.com/google/kmsan.git master e67f4ba870c2 6e262c73 .config console log report info ci-upstream-kmsan-gce-386
2020/09/09 08:11 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce-386
2020/09/08 20:23 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce-386
2020/09/08 07:17 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce-386
2020/09/08 05:13 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce-386
2020/09/08 01:22 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce-386
2020/09/07 19:10 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce-386
2020/09/07 00:31 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce-386
2020/09/06 22:58 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce-386
2020/09/06 10:41 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce-386
2020/09/06 03:52 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce-386
2020/09/03 17:44 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce-386
2020/09/03 14:12 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce-386
2020/09/03 01:12 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce-386
2020/09/02 22:48 https://github.com/google/kmsan.git master 3b3ea6028136 abf9ba4f .config console log report ci-upstream-kmsan-gce-386
2020/09/01 21:29 https://github.com/google/kmsan.git master 3b3ea6028136 d5a3ae1f .config console log report ci-upstream-kmsan-gce-386
2020/08/30 15:13 https://github.com/google/kmsan.git master 3b3ea6028136 d5a3ae1f .config console log report ci-upstream-kmsan-gce-386
2020/08/30 04:43 https://github.com/google/kmsan.git master 3b3ea6028136 d5a3ae1f .config console log report ci-upstream-kmsan-gce-386
2020/08/30 04:35 https://github.com/google/kmsan.git master 3b3ea6028136 d5a3ae1f .config console log report ci-upstream-kmsan-gce-386
2020/08/29 23:39 https://github.com/google/kmsan.git master 3b3ea6028136 d5a3ae1f .config console log report ci-upstream-kmsan-gce-386
2020/08/29 07:07 https://github.com/google/kmsan.git master 3b3ea6028136 d5a3ae1f .config console log report ci-upstream-kmsan-gce-386
2020/08/09 10:17 https://github.com/google/kmsan.git master ce8056d1f79e f721e4a0 .config console log report ci-upstream-kmsan-gce-386
2020/08/08 01:22 https://github.com/google/kmsan.git master 05fd5f9f0208 cb436c69 .config console log report ci-upstream-kmsan-gce-386
2020/08/07 21:45 https://github.com/google/kmsan.git master 05fd5f9f0208 cb436c69 .config console log report ci-upstream-kmsan-gce-386
* Struck through repros no longer work on HEAD.