netdev - KMSAN: uninit-value in ip_tunnel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Thu, 7 Dec 2023 21:27:46 +0800
From: xingwei lee <xrivendell7@...il.com>
To: davem@...emloft.net
Cc: dsahern@...nel.org, Eric Dumazet <edumazet@...gle.com>, kuba@...nel.org, 
	pabeni@...hat.com, netdev@...r.kernel.org, linux-kernel@...r.kernel.org, 
	syzkaller@...glegroups.com, 
	syzbot+4a2c52677a8a1aa283cb@...kaller.appspotmail.com
Subject: KMSAN: uninit-value in ip_tunnel_xmit

Hello,

When fuzzing the latest upstream linux 6.7-rc4,  the following crash
was triggered.
HEAD commit: bee0e7762ad2c6025b9f5245c040fcc36ef2bde8

If you fix this issue, please add the following tag to the commit:
Reported-by: xingwei Lee <xrivendell7@...il.com>

console_log: https://gist.github.com/xrivendell7/b41fbc928cd203823783fd90c98b6583#file-console_log
report: https://gist.github.com/xrivendell7/b41fbc928cd203823783fd90c98b6583#file-report
kernel commit: bee0e7762ad2c6025b9f5245c040fcc36ef2bde8
kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=ce27066613dacbb6
repro.c: https://gist.github.com/xrivendell7/b41fbc928cd203823783fd90c98b6583#file-repro-c
repro.txt: https://gist.github.com/xrivendell7/b41fbc928cd203823783fd90c98b6583#file-repro-txt

In the lasted kernel: bee0e7762ad2c6025b9f5245c040fcc36ef2bde8 the
[  199.471467][ T8590] =====================================================
[  199.475015][ T8590] BUG: KMSAN: uninit-value in ip_tunnel_xmit+0x857/0x3e80
[  199.478180][ T8590]  ip_tunnel_xmit+0x857/0x3e80
[  199.480541][ T8590]  ipgre_xmit+0xd1c/0xe20
[  199.482393][ T8590]  dev_hard_start_xmit+0x247/0xa10
[  199.484530][ T8590]  __dev_queue_xmit+0x33b8/0x5130
[  199.486433][ T8590]  __bpf_redirect+0xdd7/0x1600
[  199.488258][ T8590]  bpf_clone_redirect+0x328/0x470
[  199.490250][ T8590]  ___bpf_prog_run+0x2180/0xdb80
[  199.491997][ T8590]  __bpf_prog_run512+0xb5/0xe0
[  199.493691][ T8590]  bpf_test_run+0x482/0xb00
[  199.495215][ T8590]  bpf_prog_test_run_skb+0x14e5/0x1f20
[  199.497026][ T8590]  bpf_prog_test_run+0x6af/0xac0
[  199.498701][ T8590]  __sys_bpf+0x649/0xd60
[  199.500029][ T8590]  __x64_sys_bpf+0xa0/0xe0
[  199.501411][ T8590]  do_syscall_64+0x44/0x110
[  199.502757][ T8590]  entry_SYSCALL_64_after_hwframe+0x63/0x6b
[  199.504463][ T8590]
[  199.505159][ T8590] Uninit was created at:
[  199.506344][ T8590]  slab_post_alloc_hook+0x129/0xa70
[  199.507690][ T8590]  kmem_cache_alloc_node+0x5e9/0xb10
[  199.509191][ T8590]  kmalloc_reserve+0x13d/0x4a0
[  199.510411][ T8590]  pskb_expand_head+0x226/0x1a00
[  199.511657][ T8590]  skb_ensure_writable+0x3d3/0x460
[  199.512905][ T8590]  bpf_clone_redirect+0x17f/0x470
[  199.514135][ T8590]  ___bpf_prog_run+0x2180/0xdb80
[  199.515325][ T8590]  __bpf_prog_run512+0xb5/0xe0
[  199.516479][ T8590]  bpf_test_run+0x482/0xb00
[  199.517580][ T8590]  bpf_prog_test_run_skb+0x14e5/0x1f20
[  199.518901][ T8590]  bpf_prog_test_run+0x6af/0xac0
[  199.520015][ T8590]  __sys_bpf+0x649/0xd60
[  199.520996][ T8590]  __x64_sys_bpf+0xa0/0xe0
[  199.521949][ T8590]  do_syscall_64+0x44/0x110
[  199.522926][ T8590]  entry_SYSCALL_64_after_hwframe+0x63/0x6b

and I notice the problem is reported at 2018/2020 and seems fixed twice.

https://syzkaller.appspot.com/bug?id=f62d236e2fceaeb104f4e8f77d2324ef9da4b41b
https://syzkaller.appspot.com/bug?extid=4a2c52677a8a1aa283cb



If you fix this issue, please add the following tag to the commit:
Reported-by: Yikebaer Aizezi <yikebaer61@...il.com>