KMSAN: uninit-value in tcp

KMSAN: uninit-value in tcp_recvmsg (3)

Status: fixed on 2024/02/09 18:39
Subsystems: net
[Documentation on labels]
Fix commit: 78fbb92af27d nbd: always initialize struct msghdr completely
First crash: 562d, last: 562d

▶ ▼ Similar bugs (2)

Kernel	Title	Rank 🛈	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	KMSAN: uninit-value in tcp_recvmsg net	7	C			25918	993d	1118d	22/29	fixed on 2023/02/24 13:50
upstream	KMSAN: uninit-value in tcp_recvmsg (2) net	7				5	641d	653d	0/29	closed as invalid on 2023/12/22 15:49

Sample crash report:

=====================================================
BUG: KMSAN: uninit-value in tcp_recvmsg+0x686/0xac0 net/ipv4/tcp.c:2571
 tcp_recvmsg+0x686/0xac0 net/ipv4/tcp.c:2571
 inet_recvmsg+0x131/0x580 net/ipv4/af_inet.c:879
 sock_recvmsg_nosec net/socket.c:1044 [inline]
 sock_recvmsg+0x12b/0x1e0 net/socket.c:1066
 __sock_xmit+0x236/0x5c0 drivers/block/nbd.c:538
 nbd_read_reply drivers/block/nbd.c:732 [inline]
 recv_work+0x262/0x3100 drivers/block/nbd.c:863
 process_one_work kernel/workqueue.c:2627 [inline]
 process_scheduled_works+0x104e/0x1e70 kernel/workqueue.c:2700
 worker_thread+0xf45/0x1490 kernel/workqueue.c:2781
 kthread+0x3ed/0x540 kernel/kthread.c:388
 ret_from_fork+0x66/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242

Local variable msg created at:
 __sock_xmit+0x4c/0x5c0 drivers/block/nbd.c:513
 nbd_read_reply drivers/block/nbd.c:732 [inline]
 recv_work+0x262/0x3100 drivers/block/nbd.c:863

CPU: 1 PID: 7465 Comm: kworker/u5:1 Not tainted 6.7.0-rc7-syzkaller-00041-gf016f7547aee #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
Workqueue: nbd5-recv recv_work
=====================================================

Crashes (1):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2023/12/30 07:10	upstream	f016f7547aee	fb427a07	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kmsan-gce-386-root	KMSAN: uninit-value in tcp_recvmsg

* ~~Struck through~~ repros no longer work on HEAD.