KMSAN: uninit-value in tcp_recvmsg (3)

Status: fixed on 2024/02/09 18:39
Subsystems: net
[Documentation on labels]
Fix commit: 78fbb92af27d nbd: always initialize struct msghdr completely
First crash: 948d, last: 948d
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in tcp_recvmsg net 7 syz, C 25918 1379d 1504d 22/29 fixed on 2023/02/24 13:50
upstream KMSAN: uninit-value in tcp_recvmsg (2) net 7 5 1027d 1039d 0/29 closed as invalid on 2023/12/22 15:49

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in tcp_recvmsg+0x686/0xac0 net/ipv4/tcp.c:2571
 tcp_recvmsg+0x686/0xac0 net/ipv4/tcp.c:2571
 inet_recvmsg+0x131/0x580 net/ipv4/af_inet.c:879
 sock_recvmsg_nosec net/socket.c:1044 [inline]
 sock_recvmsg+0x12b/0x1e0 net/socket.c:1066
 __sock_xmit+0x236/0x5c0 drivers/block/nbd.c:538
 nbd_read_reply drivers/block/nbd.c:732 [inline]
 recv_work+0x262/0x3100 drivers/block/nbd.c:863
 process_one_work kernel/workqueue.c:2627 [inline]
 process_scheduled_works+0x104e/0x1e70 kernel/workqueue.c:2700
 worker_thread+0xf45/0x1490 kernel/workqueue.c:2781
 kthread+0x3ed/0x540 kernel/kthread.c:388
 ret_from_fork+0x66/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242

Local variable msg created at:
 __sock_xmit+0x4c/0x5c0 drivers/block/nbd.c:513
 nbd_read_reply drivers/block/nbd.c:732 [inline]
 recv_work+0x262/0x3100 drivers/block/nbd.c:863

CPU: 1 PID: 7465 Comm: kworker/u5:1 Not tainted 6.7.0-rc7-syzkaller-00041-gf016f7547aee #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
Workqueue: nbd5-recv recv_work
=====================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/12/30 07:10 upstream f016f7547aee fb427a07 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in tcp_recvmsg
* Struck through repros no longer work on HEAD.