KMSAN: uninit-value in hci_event_packet

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: c10a026b kmsan: use __free_pages() in kmsan_iounmap_page_r..
git tree: kmsan
console output: https://syzkaller.appspot.com/x/log.txt?x=11c903a3200000
kernel config: https://syzkaller.appspot.com/x/.config?x=a5675814e8eae69e
dashboard link: https://syzkaller.appspot.com/bug?extid=4918ee47ac82d51de00d
compiler: clang version 8.0.0 (trunk 350509)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13b4634d200000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=150657ef200000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+4918ee...@syzkaller.appspotmail.com

IPVS: ftp: loaded support on port[0] = 21
==================================================================
BUG: KMSAN: uninit-value in hci_conn_complete_evt
net/bluetooth/hci_event.c:2440 [inline]
BUG: KMSAN: uninit-value in hci_event_packet+0x126e8/0x35290
net/bluetooth/hci_event.c:5781
CPU: 1 PID: 10735 Comm: kworker/u5:1 Not tainted 5.0.0+ #16
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: hci0 hci_rx_work
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x173/0x1d0 lib/dump_stack.c:113
kmsan_report+0x131/0x2a0 mm/kmsan/kmsan.c:636
__msan_warning+0x7a/0xf0 mm/kmsan/kmsan_instr.c:310
hci_conn_complete_evt net/bluetooth/hci_event.c:2440 [inline]
hci_event_packet+0x126e8/0x35290 net/bluetooth/hci_event.c:5781
hci_rx_work+0x478/0xcc0 net/bluetooth/hci_core.c:4412
process_one_work+0x1607/0x2010 kernel/workqueue.c:2173
worker_thread+0x111c/0x2460 kernel/workqueue.c:2319
kthread+0x4a1/0x4e0 kernel/kthread.c:247
ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:355

Uninit was created at:
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:205 [inline]
kmsan_internal_poison_shadow+0x92/0x150 mm/kmsan/kmsan.c:159
kmsan_kmalloc+0xa6/0x130 mm/kmsan/kmsan_hooks.c:173
kmsan_slab_alloc+0xe/0x10 mm/kmsan/kmsan_hooks.c:182
slab_post_alloc_hook mm/slab.h:445 [inline]
slab_alloc_node mm/slub.c:2773 [inline]
__kmalloc_node_track_caller+0xe9e/0xff0 mm/slub.c:4398
__kmalloc_reserve net/core/skbuff.c:140 [inline]
__alloc_skb+0x309/0xa20 net/core/skbuff.c:208
alloc_skb include/linux/skbuff.h:1012 [inline]
bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
bcsp_recv+0x1437/0x2050 drivers/bluetooth/hci_bcsp.c:685
hci_uart_tty_receive+0x35c/0x5d0 drivers/bluetooth/hci_ldisc.c:607
tty_ldisc_receive_buf+0x2ea/0x350 drivers/tty/tty_buffer.c:465
tty_port_default_receive_buf+0x14f/0x1e0 drivers/tty/tty_port.c:38
receive_buf drivers/tty/tty_buffer.c:481 [inline]
flush_to_ldisc+0x30c/0x7f0 drivers/tty/tty_buffer.c:533
process_one_work+0x1607/0x2010 kernel/workqueue.c:2173
worker_thread+0x111c/0x2460 kernel/workqueue.c:2319
kthread+0x4a1/0x4e0 kernel/kthread.c:247
ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:355
==================================================================


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches

[yepei...@gmail.com]

#syz dup: KASAN: slab-out-of-bounds Read in hci_extended_inquiry_result_evt

[syzbot]

> #syz dup: KASAN: slab-out-of-bounds Read in hci_extended_inquiry_result_evt

I see the command but can't find the corresponding bug.
Please resend the email to syzbo...@syzkaller.appspotmail.com address
that is the sender of the bug report (also present in the Reported-by tag).

>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bug...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/ea5ea161-f425-4fac-ac43-cf956f2b7285o%40googlegroups.com.