netdev - Re: KMSAN: uninit-value in ip_route_output_key_hash

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 7 Dec 2023 15:20:43 +0100
From: Eric Dumazet <edumazet@...gle.com>
To: xingwei lee <xrivendell7@...il.com>
Cc: syzbot+549e451574ba8bfd0fd6@...kaller.appspotmail.com, davem@...emloft.net, 
	glider@...gle.com, kuba@...nel.org, Alexey Kuznetsov <kuznet@....inr.ac.ru>, 
	linux-kernel@...r.kernel.org, netdev@...r.kernel.org, 
	syzkaller-bugs@...glegroups.com, yoshfuji@...ux-ipv6.org
Subject: Re: KMSAN: uninit-value in ip_route_output_key_hash_rcu (4)

On Thu, Dec 7, 2023 at 2:36 PM xingwei lee <xrivendell7@...il.com> wrote:
>
> Hello
>
> I reproduced this bug in the latest upstream linux with repro.c and repro.txt
>
> When fuzzing the latest upstream linux 6.7-rc4,  the following crash
> was triggered.
> HEAD commit: bee0e7762ad2c6025b9f5245c040fcc36ef2bde8
>
> If you fix this issue, please add the following tag to the commit:
> Reported-by: xingwei Lee <xrivendell7@...il.com>
>
> console_log: https://gist.github.com/xrivendell7/195eb3c1946ea466f9d8f5977b90c6ed#file-console_log
> report: https://gist.github.com/xrivendell7/195eb3c1946ea466f9d8f5977b90c6ed#file-report
> kernel commit: bee0e7762ad2c6025b9f5245c040fcc36ef2bde8
> kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=ce27066613dacbb6
> repro.c: https://gist.github.com/xrivendell7/195eb3c1946ea466f9d8f5977b90c6ed#file-repro-c
> repro.txt: https://gist.github.com/xrivendell7/195eb3c1946ea466f9d8f5977b90c6ed#file-repro-txt
>
> In the lasted kernel: bee0e7762ad2c6025b9f5245c040fcc36ef2bde8 the
> crash likes below:
> [  209.523497][ T8593] =====================================================
> [  209.530316][ T8593] BUG: KMSAN: uninit-value in
> ip_route_output_key_hash_rcu+0x1ee8/0x3810
> [  209.533357][ T8593]  ip_route_output_key_hash_rcu+0x1ee8/0x3810
> [  209.535524][ T8593]  ip_route_output_flow+0x14f/0x320
> [  209.537312][ T8593]  ip_tunnel_xmit+0x1450/0x3e80
> [  209.538995][ T8593]  ipgre_xmit+0xd1c/0xe20
> [  209.540511][ T8593]  dev_hard_start_xmit+0x247/0xa10
> [  209.542211][ T8593]  __dev_queue_xmit+0x33b8/0x5130
> [  209.543742][ T8593]  __bpf_redirect+0xdd7/0x1600
> [  209.545235][ T8593]  bpf_clone_redirect+0x328/0x470
> [  209.546807][ T8593]  ___bpf_prog_run+0x2180/0xdb80
> [  209.548288][ T8593]  __bpf_prog_run512+0xb5/0xe0
> [  209.549864][ T8593]  bpf_test_run+0x482/0xb00
> [  209.551178][ T8593]  bpf_prog_test_run_skb+0x14e5/0x1f20
> [  209.552612][ T8593]  bpf_prog_test_run+0x6af/0xac0
> [  209.553902][ T8593]  __sys_bpf+0x649/0xd60
> [  209.555000][ T8593]  __x64_sys_bpf+0xa0/0xe0
> [  209.556114][ T8593]  do_syscall_64+0x44/0x110
> [  209.557249][ T8593]  entry_SYSCALL_64_after_hwframe+0x63/0x6b
> [  209.558676][ T8593]
> [  209.559232][ T8593] Uninit was stored to memory at:
> [  209.560528][ T8593]  ip_tunnel_xmit+0x1161/0x3e80
> [  209.561676][ T8593]  ipgre_xmit+0xd1c/0xe20
> [  209.562711][ T8593]  dev_hard_start_xmit+0x247/0xa10
> [  209.563864][ T8593]  __dev_queue_xmit+0x33b8/0x5130
> [  209.564963][ T8593]  __bpf_redirect+0xdd7/0x1600
> [  209.566044][ T8593]  bpf_clone_redirect+0x328/0x470
> [  209.567151][ T8593]  ___bpf_prog_run+0x2180/0xdb80
> [  209.568184][ T8593]  __bpf_prog_run512+0xb5/0xe0
> [  209.569187][ T8593]  bpf_test_run+0x482/0xb00
> [  209.570201][ T8593]  bpf_prog_test_run_skb+0x14e5/0x1f20
> [  209.571308][ T8593]  bpf_prog_test_run+0x6af/0xac0
> [  209.572284][ T8593]  __sys_bpf+0x649/0xd60
> [  209.573131][ T8593]  __x64_sys_bpf+0xa0/0xe0
> [  209.574010][ T8593]  do_syscall_64+0x44/0x110
> [  209.574902][ T8593]  entry_SYSCALL_64_after_hwframe+0x63/0x6b
> [  209.576008][ T8593]
> [  209.576456][ T8593] Uninit was created at:
> [  209.577301][ T8593]  slab_post_alloc_hook+0x129/0xa70
> [  209.578284][ T8593]  kmem_cache_alloc_node+0x5e9/0xb10
> [  209.579233][ T8593]  kmalloc_reserve+0x13d/0x4a0
> [  209.580177][ T8593]  pskb_expand_head+0x226/0x1a00
> [  209.581096][ T8593]  skb_ensure_writable+0x3d3/0x460
> [  209.582015][ T8593]  bpf_clone_redirect+0x17f/0x470
> [  209.582963][ T8593]  ___bpf_prog_run+0x2180/0xdb80
> [  209.583859][ T8593]  __bpf_prog_run512+0xb5/0xe0
> [  209.584725][ T8593]  bpf_test_run+0x482/0xb00
> [  209.585556][ T8593]  bpf_prog_test_run_skb+0x14e5/0x1f20
> [  209.586527][ T8593]  bpf_prog_test_run+0x6af/0xac0
> [  209.587347][ T8593]  __sys_bpf+0x649/0xd60
> [  209.588058][ T8593]  __x64_sys_bpf+0xa0/0xe0
> [  209.588802][ T8593]  do_syscall_64+0x44/0x110
> [  209.589613][ T8593]  entry_SYSCALL_64_after_hwframe+0x63/0x6b

Please double check the latest net tree.