linux-kernel - Re: [syzbot] [net?] KMSAN: uninit-value in bpf_prog_run_generic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <000000000000ee8def061c2f1338@google.com>
Date: Mon, 01 Jul 2024 05:53:03 -0700
From: syzbot <syzbot+0e6ddb1ef80986bdfe64@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com, 
	wojciech.gladysz@...ogain.com
Subject: Re: [syzbot] [net?] KMSAN: uninit-value in bpf_prog_run_generic_xdp

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: uninit-value in bpf_prog_run_generic_xdp

=====================================================
BUG: KMSAN: uninit-value in bpf_prog_run_generic_xdp+0x13a0/0x1ee0 net/core/dev.c:4923
 bpf_prog_run_generic_xdp+0x13a0/0x1ee0 net/core/dev.c:4923
 netif_receive_generic_xdp net/core/dev.c:5005 [inline]
 do_xdp_generic+0xb68/0x1440 net/core/dev.c:5064
 __netif_receive_skb_core+0x2533/0x6190 net/core/dev.c:5405
 __netif_receive_skb_one_core net/core/dev.c:5583 [inline]
 __netif_receive_skb+0xca/0xa00 net/core/dev.c:5699
 process_backlog+0x49d/0x920 net/core/dev.c:6028
 __napi_poll+0xe7/0x980 net/core/dev.c:6679
 napi_poll net/core/dev.c:6748 [inline]
 net_rx_action+0x82a/0x1850 net/core/dev.c:6864
 __do_softirq+0x1c0/0x7d7 kernel/softirq.c:554
 do_softirq+0x9a/0x100 kernel/softirq.c:455
 __local_bh_enable_ip+0x9f/0xb0 kernel/softirq.c:382
 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline]
 _raw_spin_unlock_bh+0x2d/0x40 kernel/locking/spinlock.c:210
 spin_unlock_bh include/linux/spinlock.h:396 [inline]
 release_sock+0x219/0x250 net/core/sock.c:3559
 j1939_sk_sendmsg+0x23d8/0x2730 net/can/j1939/socket.c:1280
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg+0x30f/0x380 net/socket.c:745
 ____sys_sendmsg+0x877/0xb60 net/socket.c:2584
 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638
 __sys_sendmsg net/socket.c:2667 [inline]
 __do_sys_sendmsg net/socket.c:2676 [inline]
 __se_sys_sendmsg net/socket.c:2674 [inline]
 __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2674
 do_syscall_64+0xd5/0x1f0
 entry_SYSCALL_64_after_hwframe+0x6d/0x75

Uninit was stored to memory at:
 pskb_expand_head+0x30f/0x19d0 net/core/skbuff.c:2253
 netif_skb_check_for_xdp net/core/dev.c:4968 [inline]
 netif_receive_generic_xdp net/core/dev.c:4999 [inline]
 do_xdp_generic+0x931/0x1440 net/core/dev.c:5064
 __netif_receive_skb_core+0x2533/0x6190 net/core/dev.c:5405
 __netif_receive_skb_one_core net/core/dev.c:5583 [inline]
 __netif_receive_skb+0xca/0xa00 net/core/dev.c:5699
 process_backlog+0x49d/0x920 net/core/dev.c:6028
 __napi_poll+0xe7/0x980 net/core/dev.c:6679
 napi_poll net/core/dev.c:6748 [inline]
 net_rx_action+0x82a/0x1850 net/core/dev.c:6864
 __do_softirq+0x1c0/0x7d7 kernel/softirq.c:554

Uninit was created at:
 slab_post_alloc_hook mm/slub.c:3804 [inline]
 slab_alloc_node mm/slub.c:3845 [inline]
 kmem_cache_alloc_node+0x613/0xc50 mm/slub.c:3888
 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577
 __alloc_skb+0x35b/0x7a0 net/core/skbuff.c:668
 alloc_skb include/linux/skbuff.h:1313 [inline]
 alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6504
 sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2795
 sock_alloc_send_skb include/net/sock.h:1842 [inline]
 j1939_sk_alloc_skb net/can/j1939/socket.c:878 [inline]
 j1939_sk_send_loop net/can/j1939/socket.c:1142 [inline]
 j1939_sk_sendmsg+0xc0a/0x2730 net/can/j1939/socket.c:1277
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg+0x30f/0x380 net/socket.c:745
 ____sys_sendmsg+0x877/0xb60 net/socket.c:2584
 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638
 __sys_sendmsg net/socket.c:2667 [inline]
 __do_sys_sendmsg net/socket.c:2676 [inline]
 __se_sys_sendmsg net/socket.c:2674 [inline]
 __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2674
 do_syscall_64+0xd5/0x1f0
 entry_SYSCALL_64_after_hwframe+0x6d/0x75

CPU: 1 PID: 5441 Comm: syz-executor.0 Not tainted 6.9.0-rc1-syzkaller-00257-ge478cf26c556-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
=====================================================


Tested on:

commit:         e478cf26 Merge branch 'bpf-fix-a-couple-of-test-failur..
git tree:       https://linux.googlesource.com/linux/kernel/git/torvalds/linux
console output: https://syzkaller.appspot.com/x/log.txt?x=1648f869980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=e2599baf258ef795
dashboard link: https://syzkaller.appspot.com/bug?extid=0e6ddb1ef80986bdfe64
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=11c3ffa6980000