syzbot


KMSAN: uninit-value in mptcp_established_options

Status: upstream: reported syz repro on 2026/05/01 06:15
Subsystems: mptcp
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+ff020673c5e3d94d9478@syzkaller.appspotmail.com
Fix commit: 5e939544f9d2 mptcp: fix uninit-value in mptcp_established_options
Patched on: [ci-qemu-gce-upstream-auto ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-snapshot-upstream-root ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci-upstream-rust-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce], missing on: [ci-qemu-native-arm64-kvm ci-qemu2-riscv64 ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci2-upstream-usb]
First crash: 39d, last: 4d11h
✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision Error
5f52de13-b594-4ef7-b867-02a6d887d7bd assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ✅ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ KMSAN: uninit-value in mptcp_established_options 2026/05/07 14:10 2026/05/07 14:10 2026/05/07 17:55 06a6ee865c1ddbbe04beddc5a2bf68cc0e8aa03c
Discussions (4)
Title Replies (including bot) Last reply
[PATCH net v2 00/11] mptcp: misc fixes for v7.1-rc7 3 (3) 2026/06/04 02:10
[PATCH] mptcp: fix KMSAN: uninit-value in mptcp_established_options 13 (17) 2026/05/29 07:48
[PATCH] mptcp: zero opts->ext_copy in mptcp_established_options_dss() 2 (2) 2026/05/04 09:37
[syzbot] [mptcp?] KMSAN: uninit-value in mptcp_established_options 0 (4) 2026/05/03 23:20
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: use-after-free Read in mptcp_established_options mptcp 19 10 1938d 1938d 0/29 closed as dup on 2021/02/17 18:39
Last patch testing requests (6)
Created Duration User Patch Repo Result
2026/05/12 08:55 1h12m matttbe@kernel.org patch upstream report log
2026/05/04 17:31 36m pabeni@redhat.com patch upstream report log
2026/05/04 16:22 7m pabeni@redhat.com patch upstream error
2026/05/04 10:00 35m matttbe@kernel.org patch upstream report log
2026/05/03 23:20 33m kartikey406@gmail.com patch upstream report log
2026/05/03 14:53 40m kartikey406@gmail.com patch upstream report log

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in mptcp_write_data_fin net/mptcp/options.c:542 [inline]
BUG: KMSAN: uninit-value in mptcp_established_options_dss net/mptcp/options.c:590 [inline]
BUG: KMSAN: uninit-value in mptcp_established_options+0x112f/0x3530 net/mptcp/options.c:874
 mptcp_write_data_fin net/mptcp/options.c:542 [inline]
 mptcp_established_options_dss net/mptcp/options.c:590 [inline]
 mptcp_established_options+0x112f/0x3530 net/mptcp/options.c:874
 tcp_established_options+0x312/0xcc0 net/ipv4/tcp_output.c:1192
 __tcp_transmit_skb+0x5dc/0x5fe0 net/ipv4/tcp_output.c:1575
 __tcp_send_ack+0x967/0xad0 net/ipv4/tcp_output.c:4500
 tcp_send_ack+0x3d/0x60 net/ipv4/tcp_output.c:4506
 mptcp_subflow_shutdown+0x164/0x690 net/mptcp/protocol.c:3151
 mptcp_check_send_data_fin+0x31b/0x3d0 net/mptcp/protocol.c:3232
 __mptcp_wr_shutdown net/mptcp/protocol.c:3248 [inline]
 __mptcp_close+0x860/0x1360 net/mptcp/protocol.c:3327
 mptcp_close+0x42/0x260 net/mptcp/protocol.c:3381
 inet_release+0x1ee/0x2a0 net/ipv4/af_inet.c:442
 __sock_release net/socket.c:722 [inline]
 sock_close+0xd6/0x2f0 net/socket.c:1514
 __fput+0x60e/0x1010 fs/file_table.c:510
 ____fput+0x25/0x30 fs/file_table.c:538
 task_work_run+0x208/0x2b0 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
 exit_to_user_mode_loop+0x505/0x2420 kernel/entry/common.c:98
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
 do_syscall_64+0x261/0x3c0 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Local variable opts created at:
 __tcp_transmit_skb+0x4d/0x5fe0 net/ipv4/tcp_output.c:1536
 __tcp_send_ack+0x967/0xad0 net/ipv4/tcp_output.c:4500

CPU: 1 UID: 0 PID: 5906 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
=====================================================

Crashes (3191):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/06/04 14:52 upstream ba3e43a9e601 197909be .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/30 13:03 upstream 9215e74f228f 6b4a8443 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/26 00:01 upstream e7ae89a0c97c c69befb3 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/24 02:26 upstream 79bd2dded182 c69befb3 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/24 02:06 upstream 79bd2dded182 c69befb3 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/22 21:17 upstream 6779b50faa56 e16cf9f3 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/22 21:13 upstream 6779b50faa56 e16cf9f3 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/17 12:07 upstream 6916d5703ddf de5aae85 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/17 11:45 upstream 6916d5703ddf de5aae85 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/14 18:22 upstream e1914add2799 6ccb967e .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/14 16:58 upstream e1914add2799 6ccb967e .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/10 12:22 upstream 1bfaee9d3351 29233ece .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/10 12:15 upstream 1bfaee9d3351 29233ece .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/03 16:50 upstream 66edb901bf87 a0d91488 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/03 16:49 upstream 66edb901bf87 a0d91488 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/03 15:30 upstream 66edb901bf87 a0d91488 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/03 14:33 upstream 66edb901bf87 a0d91488 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/03 14:14 upstream 66edb901bf87 a0d91488 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/03 13:20 upstream 66edb901bf87 a0d91488 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/03 13:00 upstream 66edb901bf87 a0d91488 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/06/05 09:22 upstream 9154c4af7829 197909be .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/06/05 03:37 upstream 9154c4af7829 197909be .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/06/05 02:32 upstream 9154c4af7829 197909be .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/06/05 01:43 upstream 9154c4af7829 197909be .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/06/04 11:30 upstream ba3e43a9e601 197909be .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/06/04 10:05 upstream ba3e43a9e601 197909be .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/06/04 06:46 upstream ba3e43a9e601 197909be .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/06/04 05:04 upstream ba3e43a9e601 197909be .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/06/04 05:04 upstream ba3e43a9e601 197909be .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/06/04 03:53 upstream ba3e43a9e601 197909be .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/06/03 22:36 upstream ba3e43a9e601 234057e5 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/06/03 21:53 upstream ba3e43a9e601 234057e5 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/06/03 20:38 upstream ba3e43a9e601 234057e5 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/06/03 19:51 upstream ba3e43a9e601 234057e5 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/06/03 17:20 upstream ba3e43a9e601 234057e5 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/06/03 16:58 upstream ba3e43a9e601 234057e5 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/06/03 15:56 upstream ba3e43a9e601 234057e5 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/06/03 10:18 upstream ba3e43a9e601 3c0d2131 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/06/03 09:14 upstream ba3e43a9e601 3c0d2131 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/06/02 22:37 upstream 6f3ed7fec72f 62fe1528 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/06/02 21:28 upstream 6f3ed7fec72f 62fe1528 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/06/02 19:38 upstream 6f3ed7fec72f 62fe1528 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/06/02 18:35 upstream 6f3ed7fec72f 62fe1528 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/06/02 18:02 upstream 6f3ed7fec72f 62fe1528 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/06/02 17:02 upstream 6f3ed7fec72f 62fe1528 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/06/02 15:18 upstream 6f3ed7fec72f 62fe1528 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/06/05 11:41 upstream 9154c4af7829 197909be .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mptcp_established_options
2026/06/05 10:27 upstream 9154c4af7829 197909be .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mptcp_established_options
2026/06/05 08:01 upstream 9154c4af7829 197909be .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mptcp_established_options
2026/06/05 06:57 upstream 9154c4af7829 197909be .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mptcp_established_options
2026/06/05 06:01 upstream 9154c4af7829 197909be .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mptcp_established_options
2026/06/05 04:34 upstream 9154c4af7829 197909be .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mptcp_established_options
2026/06/04 17:48 upstream ba3e43a9e601 197909be .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mptcp_established_options
2026/06/04 16:40 upstream ba3e43a9e601 197909be .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mptcp_established_options
2026/06/04 16:11 upstream ba3e43a9e601 197909be .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mptcp_established_options
2026/06/04 13:55 upstream ba3e43a9e601 197909be .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mptcp_established_options
2026/06/04 13:50 upstream ba3e43a9e601 197909be .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mptcp_established_options
2026/06/04 12:33 upstream ba3e43a9e601 197909be .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mptcp_established_options
2026/06/04 11:11 upstream ba3e43a9e601 197909be .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mptcp_established_options
2026/06/04 09:16 upstream ba3e43a9e601 197909be .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mptcp_established_options
2026/06/04 08:09 upstream ba3e43a9e601 197909be .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mptcp_established_options
2026/06/04 08:04 upstream ba3e43a9e601 197909be .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mptcp_established_options
2026/06/03 18:50 upstream 6f3ed7fec72f 234057e5 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mptcp_established_options
2026/06/02 22:30 upstream 6f3ed7fec72f 62fe1528 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mptcp_established_options
2026/06/02 20:27 upstream 6f3ed7fec72f 62fe1528 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mptcp_established_options
2026/05/01 06:12 upstream 08d0d3466664 753c55b9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mptcp_established_options
2026/05/01 00:03 upstream 08d0d3466664 753c55b9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mptcp_established_options
* Struck through repros no longer work on HEAD.