KMSAN: uninit-value in __request_module (6)

Status: fixed on 2025/06/10 16:19
Subsystems: modules
[Documentation on labels]
Reported-by: syzbot+1fcd957a82e3a1baa94d@syzkaller.appspotmail.com
Fix commit: 5bef3ac184b5 team: better TEAM_OPTION_TYPE_STRING validation
First crash: 531d, last: 527d
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[syzbot] [modules?] KMSAN: uninit-value in __request_module (6) 1 (4) 2025/02/13 18:22
[PATCH net] team: better TEAM_OPTION_TYPE_STRING validation 3 (3) 2025/02/13 16:50
▶ ▼ Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in __request_module (4) kernel 7 3 2201d 2215d 0/29 auto-closed as invalid on 2020/11/13 14:58
upstream KMSAN: uninit-value in __request_module kernel 7 C 13 2485d 2505d 13/29 fixed on 2019/10/15 23:40
upstream KMSAN: uninit-value in __request_module (5) modules 7 1 725d 725d 0/29 auto-obsoleted due to no activity on 2024/11/06 15:36
upstream KMSAN: uninit-value in __request_module (3) kernel 7 C 58 2350d 2379d 15/29 fixed on 2020/02/18 14:31
upstream KMSAN: uninit-value in __request_module (2) kernel 7 3 2410d 2423d 15/29 fixed on 2020/01/08 01:07
▶ ▼ Last patch testing requests (4)
Created Duration User Patch Repo Result
2025/02/13 18:22 3h23m purvayeshi550@gmail.com patch upstream report log
2025/02/13 14:21 20m purvayeshi550@gmail.com patch upstream error
2025/02/11 12:34 28m edumazet@google.com patch upstream OK log
2025/02/11 09:05 24m edumazet@google.com patch upstream report log

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in string_nocheck lib/vsprintf.c:633 [inline]
BUG: KMSAN: uninit-value in string+0x3ec/0x5f0 lib/vsprintf.c:714
 string_nocheck lib/vsprintf.c:633 [inline]
 string+0x3ec/0x5f0 lib/vsprintf.c:714
 vsnprintf+0xa5d/0x1960 lib/vsprintf.c:2843
 __request_module+0x252/0x9f0 kernel/module/kmod.c:149
 team_mode_get drivers/net/team/team_core.c:480 [inline]
 team_change_mode drivers/net/team/team_core.c:607 [inline]
 team_mode_option_set+0x437/0x970 drivers/net/team/team_core.c:1401
 team_option_set drivers/net/team/team_core.c:375 [inline]
 team_nl_options_set_doit+0x1339/0x1f90 drivers/net/team/team_core.c:2661
 genl_family_rcv_msg_doit net/netlink/genetlink.c:1115 [inline]
 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
 genl_rcv_msg+0x1214/0x12c0 net/netlink/genetlink.c:1210
 netlink_rcv_skb+0x375/0x650 net/netlink/af_netlink.c:2543
 genl_rcv+0x40/0x60 net/netlink/genetlink.c:1219
 netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline]
 netlink_unicast+0xf52/0x1260 net/netlink/af_netlink.c:1348
 netlink_sendmsg+0x10da/0x11e0 net/netlink/af_netlink.c:1892
 sock_sendmsg_nosec net/socket.c:718 [inline]
 __sock_sendmsg+0x30f/0x380 net/socket.c:733
 ____sys_sendmsg+0x877/0xb60 net/socket.c:2573
 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2627
 __sys_sendmsg net/socket.c:2659 [inline]
 __do_sys_sendmsg net/socket.c:2664 [inline]
 __se_sys_sendmsg net/socket.c:2662 [inline]
 __x64_sys_sendmsg+0x212/0x3c0 net/socket.c:2662
 x64_sys_call+0x2ed6/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:47
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
 slab_post_alloc_hook mm/slub.c:4121 [inline]
 slab_alloc_node mm/slub.c:4164 [inline]
 kmem_cache_alloc_node_noprof+0x907/0xe00 mm/slub.c:4216
 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:587
 __alloc_skb+0x363/0x7b0 net/core/skbuff.c:678
 alloc_skb include/linux/skbuff.h:1331 [inline]
 netlink_alloc_large_skb+0x1b4/0x280 net/netlink/af_netlink.c:1196
 netlink_sendmsg+0xa96/0x11e0 net/netlink/af_netlink.c:1867
 sock_sendmsg_nosec net/socket.c:718 [inline]
 __sock_sendmsg+0x30f/0x380 net/socket.c:733
 ____sys_sendmsg+0x877/0xb60 net/socket.c:2573
 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2627
 __sys_sendmsg net/socket.c:2659 [inline]
 __do_sys_sendmsg net/socket.c:2664 [inline]
 __se_sys_sendmsg net/socket.c:2662 [inline]
 __x64_sys_sendmsg+0x212/0x3c0 net/socket.c:2662
 x64_sys_call+0x2ed6/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:47
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 0 UID: 0 PID: 5814 Comm: syz-executor989 Not tainted 6.14.0-rc2-syzkaller-00034-gfebbc555cf0f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
=====================================================

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/02/11 08:43 upstream febbc555cf0f 43f51a00 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in __request_module
2025/02/10 11:57 upstream a64dcfb451e2 ef44b750 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in __request_module
2025/02/14 06:35 upstream ab68d7eb7b1a d9a046cf .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in __request_module
2025/02/14 06:35 upstream ab68d7eb7b1a d9a046cf .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in __request_module
* Struck through repros no longer work on HEAD.