[syzbot] [wireless?] KMSAN: uninit-value in ieee80211_rx_handlers
9 views
Skip to first unread message
syzbot
Jul 3, 2023, 7:16:00 AM7/3/23
to da...@davemloft.net, edum...@google.com, gli...@google.com, joha...@sipsolutions.net, ku...@kernel.org, linux-...@vger.kernel.org, linux-w...@vger.kernel.org, net...@vger.kernel.org, pab...@redhat.com, syzkall...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 257152fe29be string: use __builtin_memcpy() in strlcpy/str..
git tree: https://github.com/google/kmsan.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=13ba5e6f280000
kernel config: https://syzkaller.appspot.com/x/.config?x=c7bdd043d54243c
dashboard link: https://syzkaller.appspot.com/bug?extid=be9c824e6f269d608288
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: i386
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/43dcd4dfe7e1/disk-257152fe.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f3fcd9dec66c/vmlinux-257152fe.xz
kernel image: https://storage.googleapis.com/syzbot-assets/08620f02113d/bzImage-257152fe.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+be9c82...@syzkaller.appspotmail.com
=====================================================
BUG: KMSAN: uninit-value in ieee80211_rx_h_action net/mac80211/rx.c:3716 [inline]
BUG: KMSAN: uninit-value in ieee80211_rx_handlers+0xccf5/0x10320 net/mac80211/rx.c:4110
ieee80211_rx_h_action net/mac80211/rx.c:3716 [inline]
ieee80211_rx_handlers+0xccf5/0x10320 net/mac80211/rx.c:4110
ieee80211_invoke_rx_handlers net/mac80211/rx.c:4145 [inline]
ieee80211_prepare_and_rx_handle+0x563e/0x9620 net/mac80211/rx.c:4987
ieee80211_rx_for_interface+0x88d/0x990 net/mac80211/rx.c:5072
__ieee80211_rx_handle_packet net/mac80211/rx.c:5229 [inline]
ieee80211_rx_list+0x5737/0x6550 net/mac80211/rx.c:5364
ieee80211_rx_napi+0x87/0x350 net/mac80211/rx.c:5387
ieee80211_rx include/net/mac80211.h:4918 [inline]
ieee80211_tasklet_handler+0x1a0/0x310 net/mac80211/main.c:316
tasklet_action_common+0x391/0xd30 kernel/softirq.c:798
tasklet_action+0x26/0x30 kernel/softirq.c:823
__do_softirq+0x1b7/0x78f kernel/softirq.c:571
do_softirq+0x10d/0x190 kernel/softirq.c:472
__local_bh_enable_ip+0x99/0xa0 kernel/softirq.c:396
local_bh_enable+0x28/0x30 include/linux/bottom_half.h:33
__ieee80211_tx_skb_tid_band+0x276/0x560 net/mac80211/tx.c:6057
ieee80211_tx_skb_tid+0x203/0x290 net/mac80211/tx.c:6084
ieee80211_mgmt_tx+0x1cff/0x2070 net/mac80211/offchannel.c:965
rdev_mgmt_tx net/wireless/rdev-ops.h:746 [inline]
cfg80211_mlme_mgmt_tx+0x133b/0x1ba0 net/wireless/mlme.c:815
nl80211_tx_mgmt+0x1297/0x1840 net/wireless/nl80211.c:12594
genl_family_rcv_msg_doit net/netlink/genetlink.c:968 [inline]
genl_family_rcv_msg net/netlink/genetlink.c:1048 [inline]
genl_rcv_msg+0x12ed/0x1380 net/netlink/genetlink.c:1065
netlink_rcv_skb+0x371/0x650 net/netlink/af_netlink.c:2546
genl_rcv+0x40/0x60 net/netlink/genetlink.c:1076
netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
netlink_unicast+0xf28/0x1230 net/netlink/af_netlink.c:1365
netlink_sendmsg+0x122f/0x13d0 net/netlink/af_netlink.c:1913
sock_sendmsg_nosec net/socket.c:724 [inline]
sock_sendmsg net/socket.c:747 [inline]
____sys_sendmsg+0x999/0xd50 net/socket.c:2503
___sys_sendmsg+0x28d/0x3c0 net/socket.c:2557
__sys_sendmsg+0x222/0x3c0 net/socket.c:2586
__compat_sys_sendmsg net/compat.c:346 [inline]
__do_compat_sys_sendmsg net/compat.c:353 [inline]
__se_compat_sys_sendmsg net/compat.c:350 [inline]
__ia32_compat_sys_sendmsg+0x9d/0xe0 net/compat.c:350
do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
__do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178
do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203
do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246
entry_SYSENTER_compat_after_hwframe+0x70/0x82
Uninit was stored to memory at:
skb_copy_from_linear_data_offset include/linux/skbuff.h:4088 [inline]
skb_copy_bits+0x149/0xd30 net/core/skbuff.c:2758
skb_copy+0x47f/0xa00 net/core/skbuff.c:1948
mac80211_hwsim_tx_frame_no_nl+0x18db/0x2130 drivers/net/wireless/virtual/mac80211_hwsim.c:1835
mac80211_hwsim_tx+0x1a9b/0x2a10 drivers/net/wireless/virtual/mac80211_hwsim.c:2046
drv_tx net/mac80211/driver-ops.h:35 [inline]
ieee80211_tx_frags+0x5e7/0xd90 net/mac80211/tx.c:1752
__ieee80211_tx+0x46e/0x630 net/mac80211/tx.c:1806
ieee80211_tx+0x52e/0x570 net/mac80211/tx.c:1986
ieee80211_xmit+0x54a/0x5b0 net/mac80211/tx.c:2078
__ieee80211_tx_skb_tid_band+0x271/0x560 net/mac80211/tx.c:6056
ieee80211_tx_skb_tid+0x203/0x290 net/mac80211/tx.c:6084
ieee80211_mgmt_tx+0x1cff/0x2070 net/mac80211/offchannel.c:965
rdev_mgmt_tx net/wireless/rdev-ops.h:746 [inline]
cfg80211_mlme_mgmt_tx+0x133b/0x1ba0 net/wireless/mlme.c:815
nl80211_tx_mgmt+0x1297/0x1840 net/wireless/nl80211.c:12594
genl_family_rcv_msg_doit net/netlink/genetlink.c:968 [inline]
genl_family_rcv_msg net/netlink/genetlink.c:1048 [inline]
genl_rcv_msg+0x12ed/0x1380 net/netlink/genetlink.c:1065
netlink_rcv_skb+0x371/0x650 net/netlink/af_netlink.c:2546
genl_rcv+0x40/0x60 net/netlink/genetlink.c:1076
netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
netlink_unicast+0xf28/0x1230 net/netlink/af_netlink.c:1365
netlink_sendmsg+0x122f/0x13d0 net/netlink/af_netlink.c:1913
sock_sendmsg_nosec net/socket.c:724 [inline]
sock_sendmsg net/socket.c:747 [inline]
____sys_sendmsg+0x999/0xd50 net/socket.c:2503
___sys_sendmsg+0x28d/0x3c0 net/socket.c:2557
__sys_sendmsg+0x222/0x3c0 net/socket.c:2586
__compat_sys_sendmsg net/compat.c:346 [inline]
__do_compat_sys_sendmsg net/compat.c:353 [inline]
__se_compat_sys_sendmsg net/compat.c:350 [inline]
__ia32_compat_sys_sendmsg+0x9d/0xe0 net/compat.c:350
do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
__do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178
do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203
do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246
entry_SYSENTER_compat_after_hwframe+0x70/0x82
Uninit was created at:
slab_post_alloc_hook+0x12d/0xb60 mm/slab.h:716
slab_alloc_node mm/slub.c:3451 [inline]
kmem_cache_alloc_node+0x535/0xa30 mm/slub.c:3496
kmalloc_reserve+0x148/0x470 net/core/skbuff.c:568
__alloc_skb+0x318/0x740 net/core/skbuff.c:654
__netdev_alloc_skb+0x11a/0x6f0 net/core/skbuff.c:718
netdev_alloc_skb include/linux/skbuff.h:3204 [inline]
dev_alloc_skb include/linux/skbuff.h:3217 [inline]
ieee80211_mgmt_tx+0x1316/0x2070 net/mac80211/offchannel.c:907
rdev_mgmt_tx net/wireless/rdev-ops.h:746 [inline]
cfg80211_mlme_mgmt_tx+0x133b/0x1ba0 net/wireless/mlme.c:815
nl80211_tx_mgmt+0x1297/0x1840 net/wireless/nl80211.c:12594
genl_family_rcv_msg_doit net/netlink/genetlink.c:968 [inline]
genl_family_rcv_msg net/netlink/genetlink.c:1048 [inline]
genl_rcv_msg+0x12ed/0x1380 net/netlink/genetlink.c:1065
netlink_rcv_skb+0x371/0x650 net/netlink/af_netlink.c:2546
genl_rcv+0x40/0x60 net/netlink/genetlink.c:1076
netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
netlink_unicast+0xf28/0x1230 net/netlink/af_netlink.c:1365
netlink_sendmsg+0x122f/0x13d0 net/netlink/af_netlink.c:1913
sock_sendmsg_nosec net/socket.c:724 [inline]
sock_sendmsg net/socket.c:747 [inline]
____sys_sendmsg+0x999/0xd50 net/socket.c:2503
___sys_sendmsg+0x28d/0x3c0 net/socket.c:2557
__sys_sendmsg+0x222/0x3c0 net/socket.c:2586
__compat_sys_sendmsg net/compat.c:346 [inline]
__do_compat_sys_sendmsg net/compat.c:353 [inline]
__se_compat_sys_sendmsg net/compat.c:350 [inline]
__ia32_compat_sys_sendmsg+0x9d/0xe0 net/compat.c:350
do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
__do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178
do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203
do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246
entry_SYSENTER_compat_after_hwframe+0x70/0x82
CPU: 0 PID: 5275 Comm: syz-executor.5 Not tainted 6.4.0-syzkaller-g257152fe29be #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
=====================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to change bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 257152fe29be string: use __builtin_memcpy() in strlcpy/str..
git tree: https://github.com/google/kmsan.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=13ba5e6f280000
kernel config: https://syzkaller.appspot.com/x/.config?x=c7bdd043d54243c
dashboard link: https://syzkaller.appspot.com/bug?extid=be9c824e6f269d608288
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: i386
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/43dcd4dfe7e1/disk-257152fe.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f3fcd9dec66c/vmlinux-257152fe.xz
kernel image: https://storage.googleapis.com/syzbot-assets/08620f02113d/bzImage-257152fe.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+be9c82...@syzkaller.appspotmail.com
=====================================================
BUG: KMSAN: uninit-value in ieee80211_rx_h_action net/mac80211/rx.c:3716 [inline]
BUG: KMSAN: uninit-value in ieee80211_rx_handlers+0xccf5/0x10320 net/mac80211/rx.c:4110
ieee80211_rx_h_action net/mac80211/rx.c:3716 [inline]
ieee80211_rx_handlers+0xccf5/0x10320 net/mac80211/rx.c:4110
ieee80211_invoke_rx_handlers net/mac80211/rx.c:4145 [inline]
ieee80211_prepare_and_rx_handle+0x563e/0x9620 net/mac80211/rx.c:4987
ieee80211_rx_for_interface+0x88d/0x990 net/mac80211/rx.c:5072
__ieee80211_rx_handle_packet net/mac80211/rx.c:5229 [inline]
ieee80211_rx_list+0x5737/0x6550 net/mac80211/rx.c:5364
ieee80211_rx_napi+0x87/0x350 net/mac80211/rx.c:5387
ieee80211_rx include/net/mac80211.h:4918 [inline]
ieee80211_tasklet_handler+0x1a0/0x310 net/mac80211/main.c:316
tasklet_action_common+0x391/0xd30 kernel/softirq.c:798
tasklet_action+0x26/0x30 kernel/softirq.c:823
__do_softirq+0x1b7/0x78f kernel/softirq.c:571
do_softirq+0x10d/0x190 kernel/softirq.c:472
__local_bh_enable_ip+0x99/0xa0 kernel/softirq.c:396
local_bh_enable+0x28/0x30 include/linux/bottom_half.h:33
__ieee80211_tx_skb_tid_band+0x276/0x560 net/mac80211/tx.c:6057
ieee80211_tx_skb_tid+0x203/0x290 net/mac80211/tx.c:6084
ieee80211_mgmt_tx+0x1cff/0x2070 net/mac80211/offchannel.c:965
rdev_mgmt_tx net/wireless/rdev-ops.h:746 [inline]
cfg80211_mlme_mgmt_tx+0x133b/0x1ba0 net/wireless/mlme.c:815
nl80211_tx_mgmt+0x1297/0x1840 net/wireless/nl80211.c:12594
genl_family_rcv_msg_doit net/netlink/genetlink.c:968 [inline]
genl_family_rcv_msg net/netlink/genetlink.c:1048 [inline]
genl_rcv_msg+0x12ed/0x1380 net/netlink/genetlink.c:1065
netlink_rcv_skb+0x371/0x650 net/netlink/af_netlink.c:2546
genl_rcv+0x40/0x60 net/netlink/genetlink.c:1076
netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
netlink_unicast+0xf28/0x1230 net/netlink/af_netlink.c:1365
netlink_sendmsg+0x122f/0x13d0 net/netlink/af_netlink.c:1913
sock_sendmsg_nosec net/socket.c:724 [inline]
sock_sendmsg net/socket.c:747 [inline]
____sys_sendmsg+0x999/0xd50 net/socket.c:2503
___sys_sendmsg+0x28d/0x3c0 net/socket.c:2557
__sys_sendmsg+0x222/0x3c0 net/socket.c:2586
__compat_sys_sendmsg net/compat.c:346 [inline]
__do_compat_sys_sendmsg net/compat.c:353 [inline]
__se_compat_sys_sendmsg net/compat.c:350 [inline]
__ia32_compat_sys_sendmsg+0x9d/0xe0 net/compat.c:350
do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
__do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178
do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203
do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246
entry_SYSENTER_compat_after_hwframe+0x70/0x82
Uninit was stored to memory at:
skb_copy_from_linear_data_offset include/linux/skbuff.h:4088 [inline]
skb_copy_bits+0x149/0xd30 net/core/skbuff.c:2758
skb_copy+0x47f/0xa00 net/core/skbuff.c:1948
mac80211_hwsim_tx_frame_no_nl+0x18db/0x2130 drivers/net/wireless/virtual/mac80211_hwsim.c:1835
mac80211_hwsim_tx+0x1a9b/0x2a10 drivers/net/wireless/virtual/mac80211_hwsim.c:2046
drv_tx net/mac80211/driver-ops.h:35 [inline]
ieee80211_tx_frags+0x5e7/0xd90 net/mac80211/tx.c:1752
__ieee80211_tx+0x46e/0x630 net/mac80211/tx.c:1806
ieee80211_tx+0x52e/0x570 net/mac80211/tx.c:1986
ieee80211_xmit+0x54a/0x5b0 net/mac80211/tx.c:2078
__ieee80211_tx_skb_tid_band+0x271/0x560 net/mac80211/tx.c:6056
ieee80211_tx_skb_tid+0x203/0x290 net/mac80211/tx.c:6084
ieee80211_mgmt_tx+0x1cff/0x2070 net/mac80211/offchannel.c:965
rdev_mgmt_tx net/wireless/rdev-ops.h:746 [inline]
cfg80211_mlme_mgmt_tx+0x133b/0x1ba0 net/wireless/mlme.c:815
nl80211_tx_mgmt+0x1297/0x1840 net/wireless/nl80211.c:12594
genl_family_rcv_msg_doit net/netlink/genetlink.c:968 [inline]
genl_family_rcv_msg net/netlink/genetlink.c:1048 [inline]
genl_rcv_msg+0x12ed/0x1380 net/netlink/genetlink.c:1065
netlink_rcv_skb+0x371/0x650 net/netlink/af_netlink.c:2546
genl_rcv+0x40/0x60 net/netlink/genetlink.c:1076
netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
netlink_unicast+0xf28/0x1230 net/netlink/af_netlink.c:1365
netlink_sendmsg+0x122f/0x13d0 net/netlink/af_netlink.c:1913
sock_sendmsg_nosec net/socket.c:724 [inline]
sock_sendmsg net/socket.c:747 [inline]
____sys_sendmsg+0x999/0xd50 net/socket.c:2503
___sys_sendmsg+0x28d/0x3c0 net/socket.c:2557
__sys_sendmsg+0x222/0x3c0 net/socket.c:2586
__compat_sys_sendmsg net/compat.c:346 [inline]
__do_compat_sys_sendmsg net/compat.c:353 [inline]
__se_compat_sys_sendmsg net/compat.c:350 [inline]
__ia32_compat_sys_sendmsg+0x9d/0xe0 net/compat.c:350
do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
__do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178
do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203
do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246
entry_SYSENTER_compat_after_hwframe+0x70/0x82
Uninit was created at:
slab_post_alloc_hook+0x12d/0xb60 mm/slab.h:716
slab_alloc_node mm/slub.c:3451 [inline]
kmem_cache_alloc_node+0x535/0xa30 mm/slub.c:3496
kmalloc_reserve+0x148/0x470 net/core/skbuff.c:568
__alloc_skb+0x318/0x740 net/core/skbuff.c:654
__netdev_alloc_skb+0x11a/0x6f0 net/core/skbuff.c:718
netdev_alloc_skb include/linux/skbuff.h:3204 [inline]
dev_alloc_skb include/linux/skbuff.h:3217 [inline]
ieee80211_mgmt_tx+0x1316/0x2070 net/mac80211/offchannel.c:907
rdev_mgmt_tx net/wireless/rdev-ops.h:746 [inline]
cfg80211_mlme_mgmt_tx+0x133b/0x1ba0 net/wireless/mlme.c:815
nl80211_tx_mgmt+0x1297/0x1840 net/wireless/nl80211.c:12594
genl_family_rcv_msg_doit net/netlink/genetlink.c:968 [inline]
genl_family_rcv_msg net/netlink/genetlink.c:1048 [inline]
genl_rcv_msg+0x12ed/0x1380 net/netlink/genetlink.c:1065
netlink_rcv_skb+0x371/0x650 net/netlink/af_netlink.c:2546
genl_rcv+0x40/0x60 net/netlink/genetlink.c:1076
netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
netlink_unicast+0xf28/0x1230 net/netlink/af_netlink.c:1365
netlink_sendmsg+0x122f/0x13d0 net/netlink/af_netlink.c:1913
sock_sendmsg_nosec net/socket.c:724 [inline]
sock_sendmsg net/socket.c:747 [inline]
____sys_sendmsg+0x999/0xd50 net/socket.c:2503
___sys_sendmsg+0x28d/0x3c0 net/socket.c:2557
__sys_sendmsg+0x222/0x3c0 net/socket.c:2586
__compat_sys_sendmsg net/compat.c:346 [inline]
__do_compat_sys_sendmsg net/compat.c:353 [inline]
__se_compat_sys_sendmsg net/compat.c:350 [inline]
__ia32_compat_sys_sendmsg+0x9d/0xe0 net/compat.c:350
do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
__do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178
do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203
do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246
entry_SYSENTER_compat_after_hwframe+0x70/0x82
CPU: 0 PID: 5275 Comm: syz-executor.5 Not tainted 6.4.0-syzkaller-g257152fe29be #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
=====================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to change bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Jul 30, 2023, 8:06:48 AM7/30/23
to da...@davemloft.net, edum...@google.com, gli...@google.com, joha...@sipsolutions.net, ku...@kernel.org, linux-...@vger.kernel.org, linux-w...@vger.kernel.org, net...@vger.kernel.org, pab...@redhat.com, syzkall...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 12214540ad87 Merge tag 'loongarch-fixes-6.5-1' of git://gi..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=12e82519a80000
kernel config: https://syzkaller.appspot.com/x/.config?x=6271275e6c8ac3e0
dashboard link: https://syzkaller.appspot.com/bug?extid=be9c824e6f269d608288
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12a5f4eea80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=143b7009a80000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7e436d64cced/disk-12214540.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/100ff4913bc4/vmlinux-12214540.xz
kernel image: https://storage.googleapis.com/syzbot-assets/0a1e5a392dce/bzImage-12214540.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+be9c82...@syzkaller.appspotmail.com
=====================================================
BUG: KMSAN: uninit-value in ieee80211_rx_h_action net/mac80211/rx.c:3735 [inline]
BUG: KMSAN: uninit-value in ieee80211_rx_handlers+0xc12c/0x10c00 net/mac80211/rx.c:4129
ieee80211_rx_h_action net/mac80211/rx.c:3735 [inline]
ieee80211_rx_handlers+0xc12c/0x10c00 net/mac80211/rx.c:4129
ieee80211_invoke_rx_handlers net/mac80211/rx.c:4164 [inline]
ieee80211_prepare_and_rx_handle+0x563e/0x9640 net/mac80211/rx.c:5006
ieee80211_rx_for_interface+0x88d/0x990 net/mac80211/rx.c:5091
__ieee80211_rx_handle_packet net/mac80211/rx.c:5248 [inline]
ieee80211_rx_list+0x5753/0x6580 net/mac80211/rx.c:5383
ieee80211_rx_napi+0x87/0x350 net/mac80211/rx.c:5406
ieee80211_rx include/net/mac80211.h:4949 [inline]
ieee80211_tasklet_handler+0x1a0/0x310 net/mac80211/main.c:316
tasklet_action_common+0x391/0xd30 kernel/softirq.c:780
tasklet_action+0x26/0x30 kernel/softirq.c:805
__do_softirq+0x1b7/0x78f kernel/softirq.c:553
do_softirq+0x9a/0xf0 kernel/softirq.c:454
__local_bh_enable_ip+0x99/0xa0 kernel/softirq.c:381
local_bh_enable+0x28/0x30 include/linux/bottom_half.h:33
__ieee80211_tx_skb_tid_band+0x276/0x560 net/mac80211/tx.c:6060
ieee80211_tx_skb_tid+0x203/0x290 net/mac80211/tx.c:6087
ieee80211_mgmt_tx+0x1cff/0x2070 net/mac80211/offchannel.c:965
rdev_mgmt_tx net/wireless/rdev-ops.h:758 [inline]
cfg80211_mlme_mgmt_tx+0x133b/0x1ba0 net/wireless/mlme.c:815
nl80211_tx_mgmt+0x1297/0x1840 net/wireless/nl80211.c:12633
genl_family_rcv_msg_doit net/netlink/genetlink.c:970 [inline]
genl_family_rcv_msg net/netlink/genetlink.c:1050 [inline]
genl_rcv_msg+0x1328/0x13c0 net/netlink/genetlink.c:1067
netlink_rcv_skb+0x371/0x650 net/netlink/af_netlink.c:2549
genl_rcv+0x40/0x60 net/netlink/genetlink.c:1078
sock_sendmsg_nosec net/socket.c:725 [inline]
sock_sendmsg net/socket.c:748 [inline]
____sys_sendmsg+0x9c2/0xd60 net/socket.c:2494
___sys_sendmsg+0x28d/0x3c0 net/socket.c:2548
__sys_sendmsg net/socket.c:2577 [inline]
__do_sys_sendmsg net/socket.c:2586 [inline]
__se_sys_sendmsg net/socket.c:2584 [inline]
__x64_sys_sendmsg+0x307/0x490 net/socket.c:2584
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Uninit was stored to memory at:
skb_copy_from_linear_data_offset include/linux/skbuff.h:4068 [inline]
skb_copy_bits+0x149/0xd30 net/core/skbuff.c:2744
skb_copy+0x47f/0xa00 net/core/skbuff.c:1936
mac80211_hwsim_tx_frame_no_nl+0x18db/0x2130 drivers/net/wireless/virtual/mac80211_hwsim.c:1836
mac80211_hwsim_tx+0x1baa/0x2ce0 drivers/net/wireless/virtual/mac80211_hwsim.c:2054
drv_tx net/mac80211/driver-ops.h:37 [inline]
ieee80211_tx_frags+0x5e7/0xd90 net/mac80211/tx.c:1737
__ieee80211_tx+0x46e/0x630 net/mac80211/tx.c:1791
ieee80211_tx+0x52e/0x570 net/mac80211/tx.c:1971
ieee80211_xmit+0x54a/0x5b0 net/mac80211/tx.c:2063
__ieee80211_tx_skb_tid_band+0x271/0x560 net/mac80211/tx.c:6059
ieee80211_tx_skb_tid+0x203/0x290 net/mac80211/tx.c:6087
ieee80211_mgmt_tx+0x1cff/0x2070 net/mac80211/offchannel.c:965
rdev_mgmt_tx net/wireless/rdev-ops.h:758 [inline]
cfg80211_mlme_mgmt_tx+0x133b/0x1ba0 net/wireless/mlme.c:815
nl80211_tx_mgmt+0x1297/0x1840 net/wireless/nl80211.c:12633
genl_family_rcv_msg_doit net/netlink/genetlink.c:970 [inline]
genl_family_rcv_msg net/netlink/genetlink.c:1050 [inline]
genl_rcv_msg+0x1328/0x13c0 net/netlink/genetlink.c:1067
netlink_rcv_skb+0x371/0x650 net/netlink/af_netlink.c:2549
genl_rcv+0x40/0x60 net/netlink/genetlink.c:1078
sock_sendmsg_nosec net/socket.c:725 [inline]
sock_sendmsg net/socket.c:748 [inline]
____sys_sendmsg+0x9c2/0xd60 net/socket.c:2494
___sys_sendmsg+0x28d/0x3c0 net/socket.c:2548
__sys_sendmsg net/socket.c:2577 [inline]
__do_sys_sendmsg net/socket.c:2586 [inline]
__se_sys_sendmsg net/socket.c:2584 [inline]
__x64_sys_sendmsg+0x307/0x490 net/socket.c:2584
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Uninit was created at:
slab_post_alloc_hook+0x12f/0xb70 mm/slab.h:767
slab_alloc_node mm/slub.c:3470 [inline]
kmem_cache_alloc_node+0x577/0xa80 mm/slub.c:3515
kmalloc_reserve+0x148/0x470 net/core/skbuff.c:559
__alloc_skb+0x318/0x740 net/core/skbuff.c:644
__netdev_alloc_skb+0x11a/0x6f0 net/core/skbuff.c:708
netdev_alloc_skb include/linux/skbuff.h:3212 [inline]
dev_alloc_skb include/linux/skbuff.h:3225 [inline]
ieee80211_mgmt_tx+0x1316/0x2070 net/mac80211/offchannel.c:907
rdev_mgmt_tx net/wireless/rdev-ops.h:758 [inline]
cfg80211_mlme_mgmt_tx+0x133b/0x1ba0 net/wireless/mlme.c:815
nl80211_tx_mgmt+0x1297/0x1840 net/wireless/nl80211.c:12633
genl_family_rcv_msg_doit net/netlink/genetlink.c:970 [inline]
genl_family_rcv_msg net/netlink/genetlink.c:1050 [inline]
genl_rcv_msg+0x1328/0x13c0 net/netlink/genetlink.c:1067
netlink_rcv_skb+0x371/0x650 net/netlink/af_netlink.c:2549
genl_rcv+0x40/0x60 net/netlink/genetlink.c:1078
sock_sendmsg_nosec net/socket.c:725 [inline]
sock_sendmsg net/socket.c:748 [inline]
____sys_sendmsg+0x9c2/0xd60 net/socket.c:2494
___sys_sendmsg+0x28d/0x3c0 net/socket.c:2548
__sys_sendmsg net/socket.c:2577 [inline]
__do_sys_sendmsg net/socket.c:2586 [inline]
__se_sys_sendmsg net/socket.c:2584 [inline]
__x64_sys_sendmsg+0x307/0x490 net/socket.c:2584
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
CPU: 1 PID: 4993 Comm: syz-executor798 Not tainted 6.5.0-rc3-syzkaller-00283-g12214540ad87 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023
=====================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
HEAD commit: 12214540ad87 Merge tag 'loongarch-fixes-6.5-1' of git://gi..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=12e82519a80000
kernel config: https://syzkaller.appspot.com/x/.config?x=6271275e6c8ac3e0
dashboard link: https://syzkaller.appspot.com/bug?extid=be9c824e6f269d608288
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12a5f4eea80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=143b7009a80000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7e436d64cced/disk-12214540.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/100ff4913bc4/vmlinux-12214540.xz
kernel image: https://storage.googleapis.com/syzbot-assets/0a1e5a392dce/bzImage-12214540.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+be9c82...@syzkaller.appspotmail.com
=====================================================
BUG: KMSAN: uninit-value in ieee80211_rx_handlers+0xc12c/0x10c00 net/mac80211/rx.c:4129
ieee80211_rx_h_action net/mac80211/rx.c:3735 [inline]
ieee80211_rx_handlers+0xc12c/0x10c00 net/mac80211/rx.c:4129
ieee80211_invoke_rx_handlers net/mac80211/rx.c:4164 [inline]
ieee80211_prepare_and_rx_handle+0x563e/0x9640 net/mac80211/rx.c:5006
ieee80211_rx_for_interface+0x88d/0x990 net/mac80211/rx.c:5091
__ieee80211_rx_handle_packet net/mac80211/rx.c:5248 [inline]
ieee80211_rx_list+0x5753/0x6580 net/mac80211/rx.c:5383
ieee80211_rx_napi+0x87/0x350 net/mac80211/rx.c:5406
ieee80211_rx include/net/mac80211.h:4949 [inline]
ieee80211_tasklet_handler+0x1a0/0x310 net/mac80211/main.c:316
tasklet_action_common+0x391/0xd30 kernel/softirq.c:780
tasklet_action+0x26/0x30 kernel/softirq.c:805
__do_softirq+0x1b7/0x78f kernel/softirq.c:553
do_softirq+0x9a/0xf0 kernel/softirq.c:454
__local_bh_enable_ip+0x99/0xa0 kernel/softirq.c:381
local_bh_enable+0x28/0x30 include/linux/bottom_half.h:33
__ieee80211_tx_skb_tid_band+0x276/0x560 net/mac80211/tx.c:6060
ieee80211_tx_skb_tid+0x203/0x290 net/mac80211/tx.c:6087
ieee80211_mgmt_tx+0x1cff/0x2070 net/mac80211/offchannel.c:965
rdev_mgmt_tx net/wireless/rdev-ops.h:758 [inline]
cfg80211_mlme_mgmt_tx+0x133b/0x1ba0 net/wireless/mlme.c:815
nl80211_tx_mgmt+0x1297/0x1840 net/wireless/nl80211.c:12633
genl_family_rcv_msg_doit net/netlink/genetlink.c:970 [inline]
genl_family_rcv_msg net/netlink/genetlink.c:1050 [inline]
genl_rcv_msg+0x1328/0x13c0 net/netlink/genetlink.c:1067
netlink_rcv_skb+0x371/0x650 net/netlink/af_netlink.c:2549
genl_rcv+0x40/0x60 net/netlink/genetlink.c:1078
netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
netlink_unicast+0xf28/0x1230 net/netlink/af_netlink.c:1365
netlink_sendmsg+0x122f/0x13d0 net/netlink/af_netlink.c:1914
netlink_unicast+0xf28/0x1230 net/netlink/af_netlink.c:1365
sock_sendmsg_nosec net/socket.c:725 [inline]
sock_sendmsg net/socket.c:748 [inline]
____sys_sendmsg+0x9c2/0xd60 net/socket.c:2494
___sys_sendmsg+0x28d/0x3c0 net/socket.c:2548
__sys_sendmsg net/socket.c:2577 [inline]
__do_sys_sendmsg net/socket.c:2586 [inline]
__se_sys_sendmsg net/socket.c:2584 [inline]
__x64_sys_sendmsg+0x307/0x490 net/socket.c:2584
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Uninit was stored to memory at:
skb_copy_bits+0x149/0xd30 net/core/skbuff.c:2744
skb_copy+0x47f/0xa00 net/core/skbuff.c:1936
mac80211_hwsim_tx_frame_no_nl+0x18db/0x2130 drivers/net/wireless/virtual/mac80211_hwsim.c:1836
mac80211_hwsim_tx+0x1baa/0x2ce0 drivers/net/wireless/virtual/mac80211_hwsim.c:2054
drv_tx net/mac80211/driver-ops.h:37 [inline]
ieee80211_tx_frags+0x5e7/0xd90 net/mac80211/tx.c:1737
__ieee80211_tx+0x46e/0x630 net/mac80211/tx.c:1791
ieee80211_tx+0x52e/0x570 net/mac80211/tx.c:1971
ieee80211_xmit+0x54a/0x5b0 net/mac80211/tx.c:2063
__ieee80211_tx_skb_tid_band+0x271/0x560 net/mac80211/tx.c:6059
ieee80211_tx_skb_tid+0x203/0x290 net/mac80211/tx.c:6087
ieee80211_mgmt_tx+0x1cff/0x2070 net/mac80211/offchannel.c:965
rdev_mgmt_tx net/wireless/rdev-ops.h:758 [inline]
cfg80211_mlme_mgmt_tx+0x133b/0x1ba0 net/wireless/mlme.c:815
nl80211_tx_mgmt+0x1297/0x1840 net/wireless/nl80211.c:12633
genl_family_rcv_msg_doit net/netlink/genetlink.c:970 [inline]
genl_family_rcv_msg net/netlink/genetlink.c:1050 [inline]
genl_rcv_msg+0x1328/0x13c0 net/netlink/genetlink.c:1067
netlink_rcv_skb+0x371/0x650 net/netlink/af_netlink.c:2549
genl_rcv+0x40/0x60 net/netlink/genetlink.c:1078
netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
netlink_unicast+0xf28/0x1230 net/netlink/af_netlink.c:1365
netlink_sendmsg+0x122f/0x13d0 net/netlink/af_netlink.c:1914
netlink_unicast+0xf28/0x1230 net/netlink/af_netlink.c:1365
sock_sendmsg_nosec net/socket.c:725 [inline]
sock_sendmsg net/socket.c:748 [inline]
____sys_sendmsg+0x9c2/0xd60 net/socket.c:2494
___sys_sendmsg+0x28d/0x3c0 net/socket.c:2548
__sys_sendmsg net/socket.c:2577 [inline]
__do_sys_sendmsg net/socket.c:2586 [inline]
__se_sys_sendmsg net/socket.c:2584 [inline]
__x64_sys_sendmsg+0x307/0x490 net/socket.c:2584
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Uninit was created at:
slab_post_alloc_hook+0x12f/0xb70 mm/slab.h:767
slab_alloc_node mm/slub.c:3470 [inline]
kmem_cache_alloc_node+0x577/0xa80 mm/slub.c:3515
kmalloc_reserve+0x148/0x470 net/core/skbuff.c:559
__alloc_skb+0x318/0x740 net/core/skbuff.c:644
__netdev_alloc_skb+0x11a/0x6f0 net/core/skbuff.c:708
netdev_alloc_skb include/linux/skbuff.h:3212 [inline]
dev_alloc_skb include/linux/skbuff.h:3225 [inline]
ieee80211_mgmt_tx+0x1316/0x2070 net/mac80211/offchannel.c:907
rdev_mgmt_tx net/wireless/rdev-ops.h:758 [inline]
cfg80211_mlme_mgmt_tx+0x133b/0x1ba0 net/wireless/mlme.c:815
nl80211_tx_mgmt+0x1297/0x1840 net/wireless/nl80211.c:12633
genl_family_rcv_msg_doit net/netlink/genetlink.c:970 [inline]
genl_family_rcv_msg net/netlink/genetlink.c:1050 [inline]
genl_rcv_msg+0x1328/0x13c0 net/netlink/genetlink.c:1067
netlink_rcv_skb+0x371/0x650 net/netlink/af_netlink.c:2549
genl_rcv+0x40/0x60 net/netlink/genetlink.c:1078
netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
netlink_unicast+0xf28/0x1230 net/netlink/af_netlink.c:1365
netlink_sendmsg+0x122f/0x13d0 net/netlink/af_netlink.c:1914
netlink_unicast+0xf28/0x1230 net/netlink/af_netlink.c:1365
sock_sendmsg_nosec net/socket.c:725 [inline]
sock_sendmsg net/socket.c:748 [inline]
____sys_sendmsg+0x9c2/0xd60 net/socket.c:2494
___sys_sendmsg+0x28d/0x3c0 net/socket.c:2548
__sys_sendmsg net/socket.c:2577 [inline]
__do_sys_sendmsg net/socket.c:2586 [inline]
__se_sys_sendmsg net/socket.c:2584 [inline]
__x64_sys_sendmsg+0x307/0x490 net/socket.c:2584
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
CPU: 1 PID: 4993 Comm: syz-executor798 Not tainted 6.5.0-rc3-syzkaller-00283-g12214540ad87 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023
=====================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
Reply all
Reply to author
Forward
0 new messages