linux-kernel - Re: KMSAN: uninit-value in ip_route_output_key_hash

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CABOYnLxJzspevWrZLOt+6jkybyUEHfYz8MFZbTuRcyyjnExiKA@mail.gmail.com>
Date:   Thu, 7 Dec 2023 21:36:29 +0800
From:   xingwei lee <xrivendell7@...il.com>
To:     syzbot+549e451574ba8bfd0fd6@...kaller.appspotmail.com
Cc:     davem@...emloft.net, glider@...gle.com, kuba@...nel.org,
        Alexey Kuznetsov <kuznet@....inr.ac.ru>,
        linux-kernel@...r.kernel.org, netdev@...r.kernel.org,
        syzkaller-bugs@...glegroups.com, yoshfuji@...ux-ipv6.org,
        Eric Dumazet <edumazet@...gle.com>
Subject: Re: KMSAN: uninit-value in ip_route_output_key_hash_rcu (4)

Hello

I reproduced this bug in the latest upstream linux with repro.c and repro.txt

When fuzzing the latest upstream linux 6.7-rc4,  the following crash
was triggered.
HEAD commit: bee0e7762ad2c6025b9f5245c040fcc36ef2bde8

If you fix this issue, please add the following tag to the commit:
Reported-by: xingwei Lee <xrivendell7@...il.com>

console_log: https://gist.github.com/xrivendell7/195eb3c1946ea466f9d8f5977b90c6ed#file-console_log
report: https://gist.github.com/xrivendell7/195eb3c1946ea466f9d8f5977b90c6ed#file-report
kernel commit: bee0e7762ad2c6025b9f5245c040fcc36ef2bde8
kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=ce27066613dacbb6
repro.c: https://gist.github.com/xrivendell7/195eb3c1946ea466f9d8f5977b90c6ed#file-repro-c
repro.txt: https://gist.github.com/xrivendell7/195eb3c1946ea466f9d8f5977b90c6ed#file-repro-txt

In the lasted kernel: bee0e7762ad2c6025b9f5245c040fcc36ef2bde8 the
crash likes below:
[  209.523497][ T8593] =====================================================
[  209.530316][ T8593] BUG: KMSAN: uninit-value in
ip_route_output_key_hash_rcu+0x1ee8/0x3810
[  209.533357][ T8593]  ip_route_output_key_hash_rcu+0x1ee8/0x3810
[  209.535524][ T8593]  ip_route_output_flow+0x14f/0x320
[  209.537312][ T8593]  ip_tunnel_xmit+0x1450/0x3e80
[  209.538995][ T8593]  ipgre_xmit+0xd1c/0xe20
[  209.540511][ T8593]  dev_hard_start_xmit+0x247/0xa10
[  209.542211][ T8593]  __dev_queue_xmit+0x33b8/0x5130
[  209.543742][ T8593]  __bpf_redirect+0xdd7/0x1600
[  209.545235][ T8593]  bpf_clone_redirect+0x328/0x470
[  209.546807][ T8593]  ___bpf_prog_run+0x2180/0xdb80
[  209.548288][ T8593]  __bpf_prog_run512+0xb5/0xe0
[  209.549864][ T8593]  bpf_test_run+0x482/0xb00
[  209.551178][ T8593]  bpf_prog_test_run_skb+0x14e5/0x1f20
[  209.552612][ T8593]  bpf_prog_test_run+0x6af/0xac0
[  209.553902][ T8593]  __sys_bpf+0x649/0xd60
[  209.555000][ T8593]  __x64_sys_bpf+0xa0/0xe0
[  209.556114][ T8593]  do_syscall_64+0x44/0x110
[  209.557249][ T8593]  entry_SYSCALL_64_after_hwframe+0x63/0x6b
[  209.558676][ T8593]
[  209.559232][ T8593] Uninit was stored to memory at:
[  209.560528][ T8593]  ip_tunnel_xmit+0x1161/0x3e80
[  209.561676][ T8593]  ipgre_xmit+0xd1c/0xe20
[  209.562711][ T8593]  dev_hard_start_xmit+0x247/0xa10
[  209.563864][ T8593]  __dev_queue_xmit+0x33b8/0x5130
[  209.564963][ T8593]  __bpf_redirect+0xdd7/0x1600
[  209.566044][ T8593]  bpf_clone_redirect+0x328/0x470
[  209.567151][ T8593]  ___bpf_prog_run+0x2180/0xdb80
[  209.568184][ T8593]  __bpf_prog_run512+0xb5/0xe0
[  209.569187][ T8593]  bpf_test_run+0x482/0xb00
[  209.570201][ T8593]  bpf_prog_test_run_skb+0x14e5/0x1f20
[  209.571308][ T8593]  bpf_prog_test_run+0x6af/0xac0
[  209.572284][ T8593]  __sys_bpf+0x649/0xd60
[  209.573131][ T8593]  __x64_sys_bpf+0xa0/0xe0
[  209.574010][ T8593]  do_syscall_64+0x44/0x110
[  209.574902][ T8593]  entry_SYSCALL_64_after_hwframe+0x63/0x6b
[  209.576008][ T8593]
[  209.576456][ T8593] Uninit was created at:
[  209.577301][ T8593]  slab_post_alloc_hook+0x129/0xa70
[  209.578284][ T8593]  kmem_cache_alloc_node+0x5e9/0xb10
[  209.579233][ T8593]  kmalloc_reserve+0x13d/0x4a0
[  209.580177][ T8593]  pskb_expand_head+0x226/0x1a00
[  209.581096][ T8593]  skb_ensure_writable+0x3d3/0x460
[  209.582015][ T8593]  bpf_clone_redirect+0x17f/0x470
[  209.582963][ T8593]  ___bpf_prog_run+0x2180/0xdb80
[  209.583859][ T8593]  __bpf_prog_run512+0xb5/0xe0
[  209.584725][ T8593]  bpf_test_run+0x482/0xb00
[  209.585556][ T8593]  bpf_prog_test_run_skb+0x14e5/0x1f20
[  209.586527][ T8593]  bpf_prog_test_run+0x6af/0xac0
[  209.587347][ T8593]  __sys_bpf+0x649/0xd60
[  209.588058][ T8593]  __x64_sys_bpf+0xa0/0xe0
[  209.588802][ T8593]  do_syscall_64+0x44/0x110
[  209.589613][ T8593]  entry_SYSCALL_64_after_hwframe+0x63/0x6b