linux-kernel - Re: [syzbot] [serial?] KMSAN: uninit-value in n_tty_receive_buf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <68d4e30e.050a0220.3a612a.0005.GAE@google.com>
Date: Wed, 24 Sep 2025 23:37:02 -0700
From: syzbot <syzbot+dd514b5f0cf048aec256@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org, rampxxxx@...il.com, 
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [serial?] KMSAN: uninit-value in n_tty_receive_buf_closing
 (3)

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: use-after-free in n_tty_receive_buf_standard

=====================================================
BUG: KMSAN: use-after-free in variable_test_bit arch/x86/include/asm/bitops.h:227 [inline]
BUG: KMSAN: use-after-free in arch_test_bit arch/x86/include/asm/bitops.h:239 [inline]
BUG: KMSAN: use-after-free in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:142 [inline]
BUG: KMSAN: use-after-free in n_tty_receive_buf_standard+0xafd/0x98a0 drivers/tty/n_tty.c:1587
 variable_test_bit arch/x86/include/asm/bitops.h:227 [inline]
 arch_test_bit arch/x86/include/asm/bitops.h:239 [inline]
 _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:142 [inline]
 n_tty_receive_buf_standard+0xafd/0x98a0 drivers/tty/n_tty.c:1587
 __receive_buf drivers/tty/n_tty.c:1624 [inline]
 n_tty_receive_buf_common+0x198b/0x2470 drivers/tty/n_tty.c:1723
 n_tty_receive_buf2+0x4c/0x60 drivers/tty/n_tty.c:1769
 tty_ldisc_receive_buf+0xc3/0x2c0 drivers/tty/tty_buffer.c:387
 tty_port_default_receive_buf+0xd7/0x1a0 drivers/tty/tty_port.c:37
 receive_buf drivers/tty/tty_buffer.c:445 [inline]
 flush_to_ldisc+0x43e/0xe30 drivers/tty/tty_buffer.c:495
 process_one_work kernel/workqueue.c:3236 [inline]
 process_scheduled_works+0xa2d/0x1b80 kernel/workqueue.c:3319
 worker_thread+0xedf/0x1590 kernel/workqueue.c:3400
 kthread+0xd5c/0xf00 kernel/kthread.c:463
 ret_from_fork+0x230/0x380 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Uninit was stored to memory at:
 n_tty_receive_buf_standard+0xaf6/0x98a0 arch/x86/include/asm/bitops.h:-1
 __receive_buf drivers/tty/n_tty.c:1624 [inline]
 n_tty_receive_buf_common+0x198b/0x2470 drivers/tty/n_tty.c:1723
 n_tty_receive_buf2+0x4c/0x60 drivers/tty/n_tty.c:1769
 tty_ldisc_receive_buf+0xc3/0x2c0 drivers/tty/tty_buffer.c:387
 tty_port_default_receive_buf+0xd7/0x1a0 drivers/tty/tty_port.c:37
 receive_buf drivers/tty/tty_buffer.c:445 [inline]
 flush_to_ldisc+0x43e/0xe30 drivers/tty/tty_buffer.c:495
 process_one_work kernel/workqueue.c:3236 [inline]
 process_scheduled_works+0xa2d/0x1b80 kernel/workqueue.c:3319
 worker_thread+0xedf/0x1590 kernel/workqueue.c:3400
 kthread+0xd5c/0xf00 kernel/kthread.c:463
 ret_from_fork+0x230/0x380 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Uninit was created at:
 slab_free_hook mm/slub.c:2348 [inline]
 slab_free mm/slub.c:4695 [inline]
 kfree+0x252/0xec0 mm/slub.c:4894
 ieee80211_inform_bss+0x12f8/0x1420 net/mac80211/scan.c:160
 rdev_inform_bss net/wireless/rdev-ops.h:418 [inline]
 cfg80211_inform_single_bss_data+0x1bd1/0x3460 net/wireless/scan.c:2380
 cfg80211_inform_bss_data+0x28e/0x8c70 net/wireless/scan.c:3235
 cfg80211_inform_bss_frame_data+0x6cd/0xaa0 net/wireless/scan.c:3326
 ieee80211_bss_info_update+0x8a4/0xaa0 net/mac80211/scan.c:226
 ieee80211_scan_rx+0xa23/0xd70 net/mac80211/scan.c:355
 __ieee80211_rx_handle_packet net/mac80211/rx.c:5186 [inline]
 ieee80211_rx_list+0x464e/0x6630 net/mac80211/rx.c:5423
 ieee80211_rx_napi+0x84/0x400 net/mac80211/rx.c:5446
 ieee80211_rx include/net/mac80211.h:5210 [inline]
 ieee80211_handle_queued_frames+0x14f/0x350 net/mac80211/main.c:453
 ieee80211_tasklet_handler+0x25/0x30 net/mac80211/main.c:472
 tasklet_action_common+0x35f/0xd70 kernel/softirq.c:829
 tasklet_action+0x2d/0x40 kernel/softirq.c:855
 handle_softirqs+0x166/0x6e0 kernel/softirq.c:579
 __do_softirq kernel/softirq.c:613 [inline]
 invoke_softirq kernel/softirq.c:453 [inline]
 __irq_exit_rcu+0x66/0x180 kernel/softirq.c:680
 irq_exit_rcu+0x12/0x20 kernel/softirq.c:696
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
 sysvec_apic_timer_interrupt+0x84/0x90 arch/x86/kernel/apic/apic.c:1050
 asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:702

CPU: 0 UID: 0 PID: 4256 Comm: kworker/u8:23 Not tainted syzkaller #0 PREEMPT(none) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Workqueue: events_unbound flush_to_ldisc
=====================================================


Tested on:

commit:         bf40f4b8 Merge tag 'probes-fixes-v6.17-rc7' of git://g..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14572ce2580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=f7564f7873be81d2
dashboard link: https://syzkaller.appspot.com/bug?extid=dd514b5f0cf048aec256
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=12499ce2580000