Message-ID: <67f53290.050a0220.12542b.0000.GAE@google.com>
Date: Tue, 08 Apr 2025 07:28:32 -0700
From: syzbot <syzbot+30db32094d453eb54941@...kaller.appspotmail.com>
To: andrew+netdev@...n.ch, davem@...emloft.net, edumazet@...gle.com, 
	kuba@...nel.org, linux-kernel@...r.kernel.org, netdev@...r.kernel.org, 
	pabeni@...hat.com, syzkaller-bugs@...glegroups.com
Subject: [syzbot] [net?] KMSAN: uninit-value in __vxlan_find_mac (2)

Hello,

syzbot found the following issue on:

HEAD commit:    92b71befc349 Merge tag 'objtool-urgent-2025-04-01' of git:..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11cdcfb0580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=a4ff50689306e9bc
dashboard link: https://syzkaller.appspot.com/bug?extid=30db32094d453eb54941
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: i386

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/3f382dc1af56/disk-92b71bef.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f4e92ae0388c/vmlinux-92b71bef.xz
kernel image: https://storage.googleapis.com/syzbot-assets/bf44161687ac/bzImage-92b71bef.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+30db32094d453eb54941@...kaller.appspotmail.com

=====================================================
BUG: KMSAN: uninit-value in __vxlan_find_mac+0x49a/0x4f0 drivers/net/vxlan/vxlan_core.c:-1
 __vxlan_find_mac+0x49a/0x4f0 drivers/net/vxlan/vxlan_core.c:-1
 vxlan_find_mac drivers/net/vxlan/vxlan_core.c:437 [inline]
 vxlan_xmit+0x174c/0x3e40 drivers/net/vxlan/vxlan_core.c:2785
 __netdev_start_xmit include/linux/netdevice.h:5201 [inline]
 netdev_start_xmit include/linux/netdevice.h:5210 [inline]
 xmit_one net/core/dev.c:3780 [inline]
 dev_hard_start_xmit+0x296/0xa40 net/core/dev.c:3796
 __dev_queue_xmit+0x3679/0x57e0 net/core/dev.c:4633
 dev_queue_xmit include/linux/netdevice.h:3350 [inline]
 __bpf_tx_skb net/core/filter.c:2135 [inline]
 __bpf_redirect_common net/core/filter.c:2179 [inline]
 __bpf_redirect+0x1514/0x1690 net/core/filter.c:2186
 ____bpf_clone_redirect net/core/filter.c:2460 [inline]
 bpf_clone_redirect+0x37f/0x500 net/core/filter.c:2430
 ___bpf_prog_run+0x12fd/0xf0b0 kernel/bpf/core.c:2018
 __bpf_prog_run512+0xc5/0xf0 kernel/bpf/core.c:2313
 bpf_dispatcher_nop_func include/linux/bpf.h:1316 [inline]
 __bpf_prog_run include/linux/filter.h:718 [inline]
 bpf_prog_run include/linux/filter.h:725 [inline]
 bpf_test_run+0x546/0xd20 net/bpf/test_run.c:434
 bpf_prog_test_run_skb+0x1906/0x25b0 net/bpf/test_run.c:1093
 bpf_prog_test_run+0x5e5/0xa30 kernel/bpf/syscall.c:4427
 __sys_bpf+0x6ce/0xdf0 kernel/bpf/syscall.c:5852
 __do_sys_bpf kernel/bpf/syscall.c:5941 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5939 [inline]
 __ia32_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5939
 ia32_sys_call+0x2126/0x41f0 arch/x86/include/generated/asm/syscalls_32.h:358
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
 __do_fast_syscall_32+0xb0/0x110 arch/x86/entry/syscall_32.c:306
 do_fast_syscall_32+0x38/0x80 arch/x86/entry/syscall_32.c:331
 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:369
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e

Uninit was created at:
 slab_post_alloc_hook mm/slub.c:4157 [inline]
 slab_alloc_node mm/slub.c:4200 [inline]
 kmem_cache_alloc_node_noprof+0x921/0xe10 mm/slub.c:4252
 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577
 pskb_expand_head+0x21f/0x1c10 net/core/skbuff.c:2247
 skb_ensure_writable+0x496/0x520 net/core/skbuff.c:6241
 __bpf_try_make_writable net/core/filter.c:1665 [inline]
 bpf_try_make_writable net/core/filter.c:1671 [inline]
 bpf_try_make_head_writable net/core/filter.c:1679 [inline]
 ____bpf_clone_redirect net/core/filter.c:2454 [inline]
 bpf_clone_redirect+0x1c5/0x500 net/core/filter.c:2430
 ___bpf_prog_run+0x12fd/0xf0b0 kernel/bpf/core.c:2018
 __bpf_prog_run512+0xc5/0xf0 kernel/bpf/core.c:2313
 bpf_dispatcher_nop_func include/linux/bpf.h:1316 [inline]
 __bpf_prog_run include/linux/filter.h:718 [inline]
 bpf_prog_run include/linux/filter.h:725 [inline]
 bpf_test_run+0x546/0xd20 net/bpf/test_run.c:434
 bpf_prog_test_run_skb+0x1906/0x25b0 net/bpf/test_run.c:1093
 bpf_prog_test_run+0x5e5/0xa30 kernel/bpf/syscall.c:4427
 __sys_bpf+0x6ce/0xdf0 kernel/bpf/syscall.c:5852
 __do_sys_bpf kernel/bpf/syscall.c:5941 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5939 [inline]
 __ia32_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5939
 ia32_sys_call+0x2126/0x41f0 arch/x86/include/generated/asm/syscalls_32.h:358
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
 __do_fast_syscall_32+0xb0/0x110 arch/x86/entry/syscall_32.c:306
 do_fast_syscall_32+0x38/0x80 arch/x86/entry/syscall_32.c:331
 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:369
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e

CPU: 0 UID: 0 PID: 9482 Comm: syz.5.941 Not tainted 6.14.0-syzkaller-12508-g92b71befc349 #0 PREEMPT(undef) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
=====================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@...glegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Powered by blists - more mailing lists