syzbot


KMSAN: uninit-value in __netif_receive_skb_core (4)

Status: auto-obsoleted due to no activity on 2025/04/11 03:48
Subsystems: bpf net
[Documentation on labels]
First crash: 154d, last: 154d
Similar bugs (7)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in __netif_receive_skb_core wireguard wireless C done 353 643d 2612d 23/28 fixed on 2023/10/12 12:47
upstream KMSAN: uninit-value in __netif_receive_skb_core (2) bpf net 22 417d 511d 0/28 closed as invalid on 2024/05/28 18:05
upstream KMSAN: uninit-value in __netif_receive_skb_core (3) bpf net 3 202d 210d 0/28 closed as invalid on 2024/12/17 17:57
android-6-1 KASAN: use-after-free Read in __netif_receive_skb_core 1 42d 42d 0/2 premoderation: reported on 2025/04/25 04:12
linux-4.19 KASAN: use-after-free Read in __netif_receive_skb_core syz error 20 1161d 1702d 0/1 upstream: reported syz repro on 2020/10/08 04:31
upstream KASAN: null-ptr-deref Read in __netif_receive_skb_core wireguard 8 851d 1130d 0/28 auto-obsoleted due to no activity on 2023/05/19 08:04
linux-4.14 KASAN: use-after-free Read in __netif_receive_skb_core syz error 19 1430d 1847d 0/1 upstream: reported syz repro on 2020/05/16 19:24

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in __netif_receive_skb_core+0x6f6/0x6f10 net/core/dev.c:5502
 __netif_receive_skb_core+0x6f6/0x6f10 net/core/dev.c:5502
 __netif_receive_skb_list_core+0x31e/0x1670 net/core/dev.c:5747
 __netif_receive_skb_list net/core/dev.c:5814 [inline]
 netif_receive_skb_list_internal+0x1085/0x1700 net/core/dev.c:5905
 netif_receive_skb_list+0x5a/0x460 net/core/dev.c:5957
 xdp_recv_frames net/bpf/test_run.c:280 [inline]
 xdp_test_run_batch net/bpf/test_run.c:361 [inline]
 bpf_test_run_xdp_live+0x2e72/0x3470 net/bpf/test_run.c:390
 bpf_prog_test_run_xdp+0xf1d/0x1ae0 net/bpf/test_run.c:1318
 bpf_prog_test_run+0x5e5/0xa30 kernel/bpf/syscall.c:4402
 __sys_bpf+0x6aa/0xd90 kernel/bpf/syscall.c:5808
 __do_sys_bpf kernel/bpf/syscall.c:5897 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5895 [inline]
 __x64_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5895
 x64_sys_call+0x329c/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:322
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
 __xdp_build_skb_from_frame+0x8d7/0x9e0 net/core/xdp.c:635
 xdp_recv_frames net/bpf/test_run.c:272 [inline]
 xdp_test_run_batch net/bpf/test_run.c:361 [inline]
 bpf_test_run_xdp_live+0x2a4a/0x3470 net/bpf/test_run.c:390
 bpf_prog_test_run_xdp+0xf1d/0x1ae0 net/bpf/test_run.c:1318
 bpf_prog_test_run+0x5e5/0xa30 kernel/bpf/syscall.c:4402
 __sys_bpf+0x6aa/0xd90 kernel/bpf/syscall.c:5808
 __do_sys_bpf kernel/bpf/syscall.c:5897 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5895 [inline]
 __x64_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5895
 x64_sys_call+0x329c/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:322
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
 __alloc_pages_noprof+0x9a7/0xe00 mm/page_alloc.c:4776
 alloc_pages_mpol_noprof+0x299/0x990 mm/mempolicy.c:2269
 alloc_pages_noprof+0x1bf/0x1e0 mm/mempolicy.c:2348
 kimage_alloc_pages kernel/kexec_core.c:273 [inline]
 kimage_alloc_normal_control_pages kernel/kexec_core.c:347 [inline]
 kimage_alloc_control_pages+0x225/0x1280 kernel/kexec_core.c:460
 kimage_alloc_init kernel/kexec.c:67 [inline]
 do_kexec_load+0x528/0xcb0 kernel/kexec.c:130
 __do_sys_kexec_load kernel/kexec.c:261 [inline]
 __se_sys_kexec_load+0x318/0x360 kernel/kexec.c:242
 __x64_sys_kexec_load+0xbd/0x110 kernel/kexec.c:242
 x64_sys_call+0x3a13/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:247
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 1 UID: 0 PID: 6372 Comm: syz.4.148 Not tainted 6.13.0-rc5-syzkaller-00012-g0bc21e701a6f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
=====================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/01/03 02:02 upstream 0bc21e701a6f d3ccff63 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in __netif_receive_skb_core
* Struck through repros no longer work on HEAD.