KMSAN: uninit-value in rtl8150

KMSAN: uninit-value in rtl8150_open (2)

Status: upstream: reported on 2026/03/25 02:40
Subsystems: net usb
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+9db6c624635564ad813c@syzkaller.appspotmail.com
Fix commit: net: usb: rtl8150: handle link status read failures
Patched on: [ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-rust-kasan-gce], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 127d, last: 55d

▶ ▼ ✨ AI Jobs (2)

ID	Workflow	Result	Correct	Bug	Created	Started	Finished	Revision	Error
a1e5ec67	assessment-security	DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌	❓	KMSAN: uninit-value in rtl8150_open (2)	2026/06/01 11:56	2026/06/01 11:56	2026/06/01 12:40	6b4a8443
cd8e3095	assessment-security		💥	KMSAN: uninit-value in rtl8150_open (2)	2026/05/15 13:36	2026/05/15 13:36	2026/05/15 13:36	9cd3beaa	failed to run ["git" "pull" "origin" "HEAD" "--depth=1" "--allow-unrelated-histories"]: exit status 1 fatal: write error: No space left on device fatal: fetch-pack: invalid index-pack output

▶ ▼ Discussions (5)

Title	Replies (including bot)	Last reply
[PATCH net-next v4] net: usb: rtl8150: handle link status read failures	3 (3)	2026/07/02 09:10
[PATCH net-next v3] net: usb: rtl8150: handle link status read failures	2 (2)	2026/06/28 20:17
[PATCH] net: usb: rtl8150: handle link status read failures	4 (4)	2026/06/28 16:40
[PATCH] usb: rtl8150: avoid using uninitialized CSCR value	10 (10)	2026/04/23 18:42
[syzbot] [usb?] [net?] KMSAN: uninit-value in rtl8150_open (2)	2 (3)	2026/03/26 00:33

▶ ▼ Similar bugs (1)

Kernel	Title	Rank 🛈	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	KMSAN: uninit-value in rtl8150_open net usb	7				3	319d	332d	0/29	auto-obsoleted due to no activity on 2025/12/19 09:52

Sample crash report:

usb 2-1: device reset failed
=====================================================
BUG: KMSAN: uninit-value in set_carrier drivers/net/usb/rtl8150.c:736 [inline]
BUG: KMSAN: uninit-value in rtl8150_open+0x1131/0x1360 drivers/net/usb/rtl8150.c:773
 set_carrier drivers/net/usb/rtl8150.c:736 [inline]
 rtl8150_open+0x1131/0x1360 drivers/net/usb/rtl8150.c:773
 __dev_open+0x8e3/0xd40 net/core/dev.c:1702
 __dev_change_flags+0x46f/0xaa0 net/core/dev.c:9758
 netif_change_flags+0x8d/0x1e0 net/core/dev.c:9821
 dev_change_flags+0x18f/0x330 net/core/dev_api.c:68
 devinet_ioctl+0x10dd/0x25a0 net/ipv4/devinet.c:1199
 inet_ioctl+0x4c0/0x6f0 net/ipv4/af_inet.c:1011
 sock_do_ioctl net/socket.c:1313 [inline]
 sock_ioctl+0x769/0x1140 net/socket.c:1434
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0x23c/0x400 fs/ioctl.c:583
 __x64_sys_ioctl+0x97/0xe0 fs/ioctl.c:583
 x64_sys_call+0x1975/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x15d/0x3c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Local variable tmp.i created at:
 set_carrier drivers/net/usb/rtl8150.c:733 [inline]
 rtl8150_open+0xc26/0x1360 drivers/net/usb/rtl8150.c:773
 __dev_open+0x8e3/0xd40 net/core/dev.c:1702

CPU: 1 UID: 0 PID: 5231 Comm: dhcpcd Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
=====================================================

Crashes (5):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	VM info	Assets (help?)	Manager	Title
2026/06/01 17:16	upstream	e43ffb69e043	8d8eeb3a	.config	console log	report	info	[disk image] [vmlinux] [kernel image]	ci-upstream-kmsan-gce-root	KMSAN: uninit-value in rtl8150_open
2026/05/30 23:54	upstream	670b77dfebe7	6b4a8443	.config	console log	report	info	[disk image] [vmlinux] [kernel image]	ci-upstream-kmsan-gce-root	KMSAN: uninit-value in rtl8150_open
2026/05/10 21:13	upstream	aa54b1d27fe0	29233ece	.config	console log	report	info	[disk image] [vmlinux] [kernel image]	ci-upstream-kmsan-gce-root	KMSAN: uninit-value in rtl8150_open
2026/05/10 21:13	upstream	aa54b1d27fe0	29233ece	.config	console log	report	info	[disk image] [vmlinux] [kernel image]	ci-upstream-kmsan-gce-root	KMSAN: uninit-value in rtl8150_open
2026/03/21 02:31	upstream	c612261bedd6	5b92003d	.config	console log	report	info	[disk image] [vmlinux] [kernel image]	ci-upstream-kmsan-gce-root	KMSAN: uninit-value in rtl8150_open

* ~~Struck through~~ repros no longer work on HEAD.